[INFO] Starting reproduction run at 20260108-105607 ANTHROPIC_BASE_URL=https://api.anthropic.com BUN_INSTALL=/root/.bun CCR_TEST_GITPROXY=1 CLAUDECODE=1 CLAUDE_CODE_CONTAINER_ID=container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison CLAUDE_CODE_DEBUG=true CLAUDE_CODE_ENTRYPOINT=remote CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR=4 CLAUDE_CODE_PROXY_RESOLVES_HOSTS=true CLAUDE_CODE_REMOTE=true CLAUDE_CODE_REMOTE_ENVIRONMENT_TYPE=cloud_default CLAUDE_CODE_REMOTE_SESSION_ID=session_01M64i3i7wYXAPWoJugvWaxC CLAUDE_CODE_SESSION_ID=5abd7c90-734c-4f13-aa30-0127125ca234 CLAUDE_CODE_VERSION=2.0.59 CLAUDE_CODE_WEBSOCKET_AUTH_FILE_DESCRIPTOR=3 CODESIGN_MCP_PORT=65291 CODESIGN_MCP_TOKEN=PB_Ol6S56Jdo86nRw9g5iL9ckhNLlnTejeJiFRzJQrE= COREPACK_ENABLE_AUTO_PIN=0 DEBIAN_FRONTEND=noninteractive DEBUGINFOD_URLS=https://debuginfod.ubuntu.com ELECTRON_GET_USE_PROXY=1 ENABLE_EXPERIMENTAL_MCP_CLI=false GIT_EDITOR=true GIT_FETCH_ARGS=--deepen 50 GLOBAL_AGENT_HTTPS_PROXY=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 GLOBAL_AGENT_HTTP_PROXY=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 GLOBAL_AGENT_NO_PROXY=localhost,127.0.0.1,169.254.169.254,metadata.google.internal,*.svc.cluster.local,*.local,*.googleapis.com,*.google.com GRADLE_HOME=/opt/gradle HOME=/root HTTPS_PROXY=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 HTTP_PROXY=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 IS_SANDBOX=yes JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64 MAVEN_HOME=/opt/maven MAX_THINKING_TOKENS=31999 MCP_TOOL_TIMEOUT=60000 NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt NO_PROXY=localhost,127.0.0.1,169.254.169.254,metadata.google.internal,*.svc.cluster.local,*.local,*.googleapis.com,*.google.com NVM_CD_FLAGS= NVM_DIR=/opt/nvm NVM_RC_VERSION= NoDefaultCurrentDirectoryInExePath=1 OLDPWD=/ OPENAI_API_KEY=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 OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE=delta PATH=/root/.local/bin:/root/.cargo/bin:/usr/local/go/bin:/opt/node22/bin:/opt/maven/bin:/opt/gradle/bin:/opt/rbenv/bin:/root/.bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin PWD=/root/.pruva/runs/ghsa-v64r-7wg9-23pr_20260108-104712 PYTHONUNBUFFERED=1 RBENV_ROOT=/opt/rbenv RBENV_SHELL=bash REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt RUSTUP_HOME=/root/.rustup RUST_BACKTRACE=1 SHELL=/bin/bash SHLVL=2 SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt YARN_HTTPS_PROXY=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 YARN_HTTP_PROXY=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 _=/usr/bin/env http_proxy=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 https_proxy=http://container_container_01AohbGD4Gs1ManGrtb3eFAv--claude_code_remote--crazy-regal-grim-poison:jwt_eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6Iks3dlRfYUVsdXIySGdsYVJ0QWJ0UThDWDU4dFFqODZIRjJlX1VsSzZkNEEifQ.eyJpc3MiOiJhbnRocm9waWMtZWdyZXNzLWNvbnRyb2wiLCJvcmdhbml6YXRpb25fdXVpZCI6IjM3NjkzMGRiLTQ3NTItNGUxOS05NDM2LTM0MTZkOWE3MWY3NyIsImlhdCI6MTc2Nzg2OTIxMCwiZXhwIjoxNzY3ODgzNjEwLCJhbGxvd2VkX2hvc3RzIjoiKiIsImlzX2hpcGFhX3JlZ3VsYXRlZCI6ImZhbHNlIiwiaXNfYW50X2hpcGkiOiJmYWxzZSIsInVzZV9lZ3Jlc3NfZ2F0ZXdheSI6ImZhbHNlIiwic2Vzc2lvbl9pZCI6InNlc3Npb25fMDFNNjRpM2k3d1lYQVBXb0p1Z3ZXYXhDIiwiY29udGFpbmVyX2lkIjoiY29udGFpbmVyXzAxQW9oYkdENEdzMU1hbkdydGIzZUZBdi0tY2xhdWRlX2NvZGVfcmVtb3RlLS1jcmF6eS1yZWdhbC1ncmltLXBvaXNvbiJ9.-PryHfk7FJAeane7kkheEQqs0xkFc4VHJUb0UrcL-y3S7gCt9wsR0ahzMn-vEUwDvJGUhBD4ft83cVzDo41owg@21.0.0.111:15004 no_proxy=localhost,127.0.0.1,169.254.169.254,metadata.google.internal,*.svc.cluster.local,*.local,*.googleapis.com,*.google.com [INFO] Installing required packages (this may take several minutes)... Hit:1 http://security.ubuntu.com/ubuntu noble-security InRelease Hit:2 http://archive.ubuntu.com/ubuntu noble InRelease Hit:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease Hit:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease Hit:5 https://ppa.launchpadcontent.net/deadsnakes/ppa/ubuntu noble InRelease Hit:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease Reading package lists... Reading package lists... Building dependency tree... Reading state information... lsb-release is already the newest version (12.0-2). ca-certificates is already the newest version (20240203). apt-transport-https is already the newest version (2.8.3). software-properties-common is already the newest version (0.99.49.3). gnupg is already the newest version (2.4.4-2ubuntu17.4). 0 upgraded, 0 newly installed, 0 to remove and 29 not upgraded. Reading package lists... Building dependency tree... Reading state information... php is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-cli is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-mbstring is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-xml is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-curl is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-zip is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-mysql is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-gd is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-intl is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-bcmath is already the newest version (2:8.4+100~+ubuntu24.04.1+deb.sury.org+1). php-imagick is already the newest version (3.8.1-1+ubuntu24.04.1+deb.sury.org+1). 0 upgraded, 0 newly installed, 0 to remove and 29 not upgraded. Reading package lists... Building dependency tree... Reading state information... mariadb-server is already the newest version (1:10.11.13-0ubuntu0.24.04.1). mariadb-client is already the newest version (1:10.11.13-0ubuntu0.24.04.1). curl is already the newest version (8.5.0-2ubuntu10.6). unzip is already the newest version (6.0-28ubuntu4.1). git is already the newest version (1:2.43.0-1ubuntu7.3). lsof is already the newest version (4.95.0-1build3). python3 is already the newest version (3.12.3-0ubuntu2.1). python3-requests is already the newest version (2.31.0+dfsg-1ubuntu1.1). 0 upgraded, 0 newly installed, 0 to remove and 29 not upgraded. [INFO] Ensuring MariaDB is running... Synchronizing state of mariadb.service with SysV service script with /usr/lib/systemd/systemd-sysv-install. Executing: /usr/lib/systemd/systemd-sysv-install enable mariadb System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down * Starting MariaDB database server mariadbd ...done. mysql: unrecognized service [INFO] Creating database and user if needed... [INFO] Creating Craft CMS project (template)... Creating a "craftcms/craft" project at "bundle/repro/craftapp" Installing craftcms/craft (5.6.0) - Installing craftcms/craft (5.6.0): Extracting archive Created project in /root/.pruva/runs/ghsa-v64r-7wg9-23pr_20260108-104712/bundle/repro/craftapp Loading composer repositories with package information Updating dependencies Lock file operations: 116 installs, 0 updates, 0 removals - Locking bacon/bacon-qr-code (2.0.8) - Locking brick/math (0.13.1) - Locking cebe/markdown (1.2.1) - Locking commerceguys/addressing (v2.2.5) - Locking composer/semver (3.4.4) - Locking craftcms/cms (5.8.21) - Locking craftcms/generator (2.2.0) - Locking craftcms/plugin-installer (1.6.0) - Locking craftcms/server-check (5.0.4) - Locking creocoder/yii2-nested-sets (0.9.0) - Locking dasprid/enum (1.0.7) - Locking defuse/php-encryption (v2.4.0) - Locking doctrine/collections (2.5.0) - Locking doctrine/deprecations (1.1.5) - Locking doctrine/lexer (3.0.1) - Locking egulias/email-validator (4.0.4) - Locking elvanto/litemoji (4.3.0) - Locking enshrined/svg-sanitize (0.22.0) - Locking ezyang/htmlpurifier (v4.19.0) - Locking graham-campbell/result-type (v1.1.4) - Locking guzzlehttp/guzzle (7.10.0) - Locking guzzlehttp/promises (2.3.0) - Locking guzzlehttp/psr7 (2.8.0) - Locking illuminate/collections (v10.49.0) - Locking illuminate/conditionable (v10.49.0) - Locking illuminate/contracts (v10.49.0) - Locking illuminate/macroable (v10.49.0) - Locking lcobucci/clock (3.5.0) - Locking league/uri (7.7.0) - Locking league/uri-interfaces (7.7.0) - Locking masterminds/html5 (2.10.0) - Locking mikehaertl/php-shellcommand (1.7.0) - Locking moneyphp/money (v4.8.0) - Locking monolog/monolog (3.10.0) - Locking nette/php-generator (v4.2.0) - Locking nette/utils (v4.1.1) - Locking nikic/php-parser (v5.7.0) - Locking paragonie/constant_time_encoding (v3.1.3) - Locking paragonie/random_compat (v9.99.100) - Locking phpdocumentor/reflection-common (2.2.0) - Locking phpdocumentor/reflection-docblock (5.6.6) - Locking phpdocumentor/type-resolver (1.12.0) - Locking phpoption/phpoption (1.9.5) - Locking phpstan/phpdoc-parser (2.3.0) - Locking pixelandtonic/imagine (1.3.3.1) - Locking pragmarx/google2fa (v8.0.3) - Locking pragmarx/random (v0.2.2) - Locking pragmarx/recovery (v0.2.1) - Locking psr/clock (1.0.0) - Locking psr/container (2.0.2) - Locking psr/event-dispatcher (1.0.0) - Locking psr/http-client (1.0.3) - Locking psr/http-factory (1.1.0) - Locking psr/http-message (2.0) - Locking psr/log (3.0.2) - Locking psr/simple-cache (3.0.0) - Locking psy/psysh (v0.12.18) - Locking ralouphie/getallheaders (3.0.3) - Locking samdark/yii2-psr-log-target (1.1.4) - Locking seld/cli-prompt (1.0.4) - Locking spomky-labs/cbor-php (3.2.2) - Locking spomky-labs/pki-framework (1.4.1) - Locking symfony/console (v8.0.3) - Locking symfony/css-selector (v7.4.0) - Locking symfony/deprecation-contracts (v3.6.0) - Locking symfony/dom-crawler (v7.4.1) - Locking symfony/event-dispatcher (v8.0.0) - Locking symfony/event-dispatcher-contracts (v3.6.0) - Locking symfony/filesystem (v6.4.30) - Locking symfony/http-client (v7.4.3) - Locking symfony/http-client-contracts (v3.6.0) - Locking symfony/mailer (v7.4.3) - Locking symfony/mime (v7.4.0) - Locking symfony/polyfill-ctype (v1.33.0) - Locking symfony/polyfill-iconv (v1.33.0) - Locking symfony/polyfill-intl-grapheme (v1.33.0) - Locking symfony/polyfill-intl-idn (v1.33.0) - Locking symfony/polyfill-intl-normalizer (v1.33.0) - Locking symfony/polyfill-mbstring (v1.33.0) - Locking symfony/polyfill-php72 (v1.31.0) - Locking symfony/polyfill-php80 (v1.33.0) - Locking symfony/polyfill-php81 (v1.33.0) - Locking symfony/polyfill-php83 (v1.33.0) - Locking symfony/polyfill-php84 (v1.33.0) - Locking symfony/polyfill-uuid (v1.33.0) - Locking symfony/process (v7.4.3) - Locking symfony/property-access (v7.4.3) - Locking symfony/property-info (v7.4.3) - Locking symfony/serializer (v6.4.31) - Locking symfony/service-contracts (v3.6.1) - Locking symfony/string (v8.0.1) - Locking symfony/type-info (v8.0.1) - Locking symfony/uid (v7.4.0) - Locking symfony/var-dumper (v5.4.48) - Locking symfony/yaml (v7.4.1) - Locking theiconic/name-parser (v1.2.11) - Locking twig/twig (v3.15.0) - Locking vlucas/phpdotenv (v5.6.3) - Locking voku/anti-xss (4.1.42) - Locking voku/arrayy (7.9.6) - Locking voku/email-check (3.1.0) - Locking voku/portable-ascii (2.0.3) - Locking voku/portable-utf8 (6.0.13) - Locking voku/stop-words (2.0.1) - Locking voku/stringy (6.5.3) - Locking voku/urlify (5.0.7) - Locking web-auth/cose-lib (4.4.2) - Locking web-auth/webauthn-lib (4.9.2) - Locking webmozart/assert (2.1.1) - Locking webonyx/graphql-php (v14.11.10) - Locking yiisoft/yii2 (2.0.52) - Locking yiisoft/yii2-composer (2.0.11) - Locking yiisoft/yii2-debug (2.1.27) - Locking yiisoft/yii2-queue (2.3.8) - Locking yiisoft/yii2-shell (2.0.6) - Locking yiisoft/yii2-symfonymailer (4.0.0) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 116 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] - Installing yiisoft/yii2-composer (2.0.11): Extracting archive - Installing craftcms/plugin-installer (1.6.0): Extracting archive - Installing symfony/polyfill-iconv (v1.33.0): Extracting archive - Installing dasprid/enum (1.0.7): Extracting archive - Installing bacon/bacon-qr-code (2.0.8): Extracting archive - Installing brick/math (0.13.1): Extracting archive - Installing cebe/markdown (1.2.1): Extracting archive - Installing symfony/polyfill-php84 (v1.33.0): Extracting archive - Installing doctrine/deprecations (1.1.5): Extracting archive - Installing doctrine/collections (2.5.0): Extracting archive - Installing commerceguys/addressing (v2.2.5): Extracting archive - Installing composer/semver (3.4.4): Extracting archive - Installing symfony/polyfill-ctype (v1.33.0): Extracting archive - Installing nikic/php-parser (v5.7.0): Extracting archive - Installing nette/utils (v4.1.1): Extracting archive - Installing nette/php-generator (v4.2.0): Extracting archive - Installing ezyang/htmlpurifier (v4.19.0): Extracting archive - Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive - Installing craftcms/cms (5.8.21): Extracting archive - Installing yiisoft/yii2 (2.0.52): Extracting archive - Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive - Installing symfony/polyfill-intl-idn (v1.33.0): Extracting archive - Installing symfony/deprecation-contracts (v3.6.0): Extracting archive - Installing symfony/mime (v7.4.0): Extracting archive - Installing psr/container (2.0.2): Extracting archive - Installing symfony/service-contracts (v3.6.1): Extracting archive - Installing psr/event-dispatcher (1.0.0): Extracting archive - Installing symfony/event-dispatcher-contracts (v3.6.0): Extracting archive - Installing symfony/event-dispatcher (v8.0.0): Extracting archive - Installing psr/log (3.0.2): Extracting archive - Installing doctrine/lexer (3.0.1): Extracting archive - Installing egulias/email-validator (4.0.4): Extracting archive - Installing symfony/mailer (v7.4.3): Extracting archive - Installing yiisoft/yii2-symfonymailer (4.0.0): Extracting archive - Installing symfony/process (v7.4.3): Extracting archive - Installing yiisoft/yii2-queue (2.3.8): Extracting archive - Installing yiisoft/yii2-debug (2.1.27): Extracting archive - Installing webonyx/graphql-php (v14.11.10): Extracting archive - Installing spomky-labs/pki-framework (1.4.1): Extracting archive - Installing web-auth/cose-lib (4.4.2): Extracting archive - Installing symfony/polyfill-uuid (v1.33.0): Extracting archive - Installing symfony/uid (v7.4.0): Extracting archive - Installing spomky-labs/cbor-php (3.2.2): Extracting archive - Installing psr/http-message (2.0): Extracting archive - Installing psr/http-factory (1.1.0): Extracting archive - Installing psr/http-client (1.0.3): Extracting archive - Installing psr/clock (1.0.0): Extracting archive - Installing paragonie/constant_time_encoding (v3.1.3): Extracting archive - Installing lcobucci/clock (3.5.0): Extracting archive - Installing web-auth/webauthn-lib (4.9.2): Extracting archive - Installing voku/stop-words (2.0.1): Extracting archive - Installing voku/portable-ascii (2.0.3): Extracting archive - Installing symfony/polyfill-php72 (v1.31.0) - Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive - Installing voku/portable-utf8 (6.0.13): Extracting archive - Installing voku/urlify (5.0.7): Extracting archive - Installing voku/email-check (3.1.0): Extracting archive - Installing webmozart/assert (2.1.1): Extracting archive - Installing phpstan/phpdoc-parser (2.3.0): Extracting archive - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive - Installing phpdocumentor/type-resolver (1.12.0): Extracting archive - Installing phpdocumentor/reflection-docblock (5.6.6): Extracting archive - Installing voku/arrayy (7.9.6): Extracting archive - Installing voku/anti-xss (4.1.42): Extracting archive - Installing paragonie/random_compat (v9.99.100): Extracting archive - Installing defuse/php-encryption (v2.4.0): Extracting archive - Installing voku/stringy (6.5.3): Extracting archive - Installing symfony/polyfill-php81 (v1.33.0): Extracting archive - Installing twig/twig (v3.15.0): Extracting archive - Installing theiconic/name-parser (v1.2.11): Extracting archive - Installing symfony/yaml (v7.4.1): Extracting archive - Installing symfony/polyfill-php80 (v1.33.0): Extracting archive - Installing symfony/var-dumper (v5.4.48): Extracting archive - Installing symfony/serializer (v6.4.31): Extracting archive - Installing symfony/type-info (v8.0.1): Extracting archive - Installing symfony/string (v8.0.1): Extracting archive - Installing symfony/property-info (v7.4.3): Extracting archive - Installing symfony/property-access (v7.4.3): Extracting archive - Installing symfony/polyfill-php83 (v1.33.0): Extracting archive - Installing symfony/http-client-contracts (v3.6.0): Extracting archive - Installing symfony/http-client (v7.4.3): Extracting archive - Installing symfony/filesystem (v6.4.30): Extracting archive - Installing masterminds/html5 (2.10.0): Extracting archive - Installing symfony/dom-crawler (v7.4.1): Extracting archive - Installing symfony/css-selector (v7.4.0): Extracting archive - Installing seld/cli-prompt (1.0.4): Extracting archive - Installing samdark/yii2-psr-log-target (1.1.4): Extracting archive - Installing pragmarx/random (v0.2.2): Extracting archive - Installing pragmarx/recovery (v0.2.1): Extracting archive - Installing pragmarx/google2fa (v8.0.3): Extracting archive - Installing pixelandtonic/imagine (1.3.3.1): Extracting archive - Installing monolog/monolog (3.10.0): Extracting archive - Installing moneyphp/money (v4.8.0): Extracting archive - Installing mikehaertl/php-shellcommand (1.7.0): Extracting archive - Installing league/uri-interfaces (7.7.0): Extracting archive - Installing league/uri (7.7.0): Extracting archive - Installing illuminate/macroable (v10.49.0): Extracting archive - Installing psr/simple-cache (3.0.0): Extracting archive - Installing illuminate/contracts (v10.49.0): Extracting archive - Installing illuminate/conditionable (v10.49.0): Extracting archive - Installing illuminate/collections (v10.49.0): Extracting archive - Installing ralouphie/getallheaders (3.0.3): Extracting archive - Installing guzzlehttp/psr7 (2.8.0): Extracting archive - Installing guzzlehttp/promises (2.3.0): Extracting archive - Installing guzzlehttp/guzzle (7.10.0): Extracting archive - Installing enshrined/svg-sanitize (0.22.0): Extracting archive - Installing elvanto/litemoji (4.3.0): Extracting archive - Installing creocoder/yii2-nested-sets (0.9.0): Extracting archive - Installing craftcms/server-check (5.0.4): Extracting archive - Installing craftcms/generator (2.2.0): Extracting archive - Installing symfony/console (v8.0.3): Extracting archive - Installing phpoption/phpoption (1.9.5): Extracting archive - Installing graham-campbell/result-type (v1.1.4): Extracting archive - Installing vlucas/phpdotenv (v5.6.3): Extracting archive - Installing psy/psysh (v0.12.18): Extracting archive - Installing yiisoft/yii2-shell (2.0.6): Extracting archive 0/113 [>---------------------------] 0% 15/113 [===>------------------------] 13% 24/113 [=====>----------------------] 21% 31/113 [=======>--------------------] 27% 35/113 [========>-------------------] 30% 46/113 [===========>----------------] 40% 59/113 [==============>-------------] 52% 74/113 [==================>---------] 65% 80/113 [===================>--------] 70% 92/113 [======================>-----] 81% 103/113 [=========================>--] 91% 112/113 [===========================>] 99% 113/113 [============================] 100% 48 package suggestions were added by new dependencies, use `composer suggest` to see details. Generating optimized autoload files 68 packages you are using are looking for funding. Use the `composer fund` command to find out more! No security vulnerability advisories found. > @php -r "file_exists('.env') || copy('.env.example.dev', '.env');" > @php -r "unlink('composer.json');" > @php -r "rename('composer.json.default', 'composer.json');" > @php craft install Craft commands should not be run as the root/super user. See https://craftcms.com/knowledge-base/craft-console-root for details on why that’s a bad idea. Craft commands should not be run as the root/super user. See https://craftcms.com/knowledge-base/craft-console-root for details on why that’s a bad idea. ______ .______ ___ _______ .___________. / || _ \ / \ | ____|| | | ,----'| |_) | / ^ \ | |__ `---| |----` | | | / / /_\ \ | __| | | | `----.| |\ \----./ _____ \ | | | | \______|| _| `._____/__/ \__\ |__| |__| A N E W I N S T A L L ______ .___ ___. _______. / || \/ | / | | ,----'| \ / | | (----` | | | |\/| | \ \ | `----.| | | | .----) | \______||__| |__| |_______/ Craft commands should not be run as the root/super user. See https://craftcms.com/knowledge-base/craft-console-root for details on why that’s a bad idea. Craft commands should not be run as the root/super user. See https://craftcms.com/knowledge-base/craft-console-root for details on why that’s a bad idea. Generating an application ID ... done (CraftCMS--736e9861-8337-446a-a512-8cd7ff37b8a8) Craft commands should not be run as the root/super user. See https://craftcms.com/knowledge-base/craft-console-root for details on why that’s a bad idea. Generating a security key ... done (DQWyK4H2XM6RLOByt94NN_zVtQUgsH6w) Welcome to Craft CMS! Run the following command if you want to setup Craft from your terminal: php ~/.pruva/runs/ghsa-v64r-7wg9-23pr_20260108-104712/bundle/repro/craftapp/craft setup [INFO] Pinning CMS to vulnerable version 5.8.19... ./composer.json has been updated Running composer update craftcms/cms --with-all-dependencies Loading composer repositories with package information Updating dependencies Lock file operations: 0 installs, 1 update, 0 removals - Downgrading craftcms/cms (5.8.21 => 5.8.19) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 0 installs, 1 update, 0 removals - Downgrading craftcms/cms (5.8.21 => 5.8.19): Extracting archive Generating optimized autoload files 68 packages you are using are looking for funding. Use the `composer fund` command to find out more! Found 5 security vulnerability advisories affecting 1 package. Run "composer audit" for a full list of advisories. [INFO] Writing .env configuration... [INFO] Ensuring backupOnUpdate is enabled... [INFO] Running Craft installation (idempotent)... Craft commands should not be run as the root/super user. See https://craftcms.com/knowledge-base/craft-console-root for details on why that’s a bad idea. Generating a security key ... done (dpSnzudKHG3fgB9jC9ipATX-e2qNfJoG) Error: Unknown option: --username. Options available: --color, --interactive, --help, --silentExitOnException, --isolated [INFO] Starting PHP built-in server on http://127.0.0.1:8080 (idempotent)... [INFO] Attempt 1: Trigger via POST /admin/actions/app/migrate (unauthenticated) [INFO] Attempt 2: Updater flow via /admin/actions/updater/index + /admin/actions/updater/backup [INFO] Attempt 3: Variant parameters to /admin/actions/app/migrate [INFO] Checking for backup evidence... [WARN] No definitive backup evidence found yet. --- CURL LOG (tail) --- --- Attempt 1 request/response --- HTTP/1.1 302 Found Host: 127.0.0.1:8080 Date: Thu, 08 Jan 2026 10:57:13 GMT Connection: close Expires: 0 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Robots-Tag: none Content-Security-Policy: frame-ancestors 'self' X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Powered-By: Craft CMS Location: http://127.0.0.1:8080/index.php?p=admin/install Content-Type: text/html; charset=UTF-8 Traceback (most recent call last): File "", line 4, in File "/root/.local/lib/python3.11/site-packages/requests/sessions.py", line 602, in get return self.request("GET", url, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/lib/python3.11/site-packages/requests/sessions.py", line 575, in request prep = self.prepare_request(req) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/lib/python3.11/site-packages/requests/sessions.py", line 484, in prepare_request p.prepare( File "/root/.local/lib/python3.11/site-packages/requests/models.py", line 367, in prepare self.prepare_url(url, params) File "/root/.local/lib/python3.11/site-packages/requests/models.py", line 438, in prepare_url raise MissingSchema( requests.exceptions.MissingSchema: Invalid URL '${BASE_URL}/admin/login': No scheme supplied. Perhaps you meant https://${BASE_URL}/admin/login? --- Attempt 3 request/response (variant) --- HTTP/1.1 302 Found Host: 127.0.0.1:8080 Date: Thu, 08 Jan 2026 10:57:17 GMT Connection: close Expires: 0 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Robots-Tag: none Content-Security-Policy: frame-ancestors 'self' X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Powered-By: Craft CMS Location: http://127.0.0.1:8080/index.php?p=admin/install Content-Type: text/html; charset=UTF-8 --- PHP SERVER LOG (tail) --- [Thu Jan 8 10:57:11 2026] PHP 8.4.16 Development Server (http://127.0.0.1:8080) started [Thu Jan 8 10:57:12 2026] 127.0.0.1:54872 Accepted [Thu Jan 8 10:57:12 2026] 127.0.0.1:54872 Closing [Thu Jan 8 10:57:12 2026] 127.0.0.1:35103 Accepted [Thu Jan 8 10:57:12 2026] 127.0.0.1:35103 Closing [Thu Jan 8 10:57:13 2026] 127.0.0.1:34684 Accepted [Thu Jan 8 10:57:13 2026] 127.0.0.1:34684 Closing [Thu Jan 8 10:57:17 2026] 127.0.0.1:40089 Accepted [Thu Jan 8 10:57:17 2026] 127.0.0.1:40089 Closing [ERROR] Reproduction NOT achieved. Check logs under /root/.pruva/runs/ghsa-v64r-7wg9-23pr_20260108-104712/bundle/logs