build(deps): bump tar from 7.5.11 to 7.5.22 via root override (critical security fix) - #304
Open
mbret wants to merge 1 commit into
Open
build(deps): bump tar from 7.5.11 to 7.5.22 via root override (critical security fix)#304mbret wants to merge 1 commit into
mbret wants to merge 1 commit into
Conversation
lerna pins tar to the exact version 7.5.11, which is affected by the critical GHSA-vmf3-w455-68vh advisory (tar parser interpretation differential / file smuggling) and five further DoS advisories fixed in 7.5.21+. An npm override moves the whole tree to the patched 7.5.x line until lerna ships a release with a fixed pin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01213s5boGTvKKmY9xzAKyjf
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The update
tar 7.5.11 → 7.5.22 (patch-level, security-motivated).
npm auditreports the tree's only critical advisory againsttar@7.5.11:All are fixed in
tar@7.5.21+.Why an override instead of a plain lockfile bump:
taris transitive —lerna@9.0.7(already the latest release) pins it to the exact version7.5.11, so no in-range update can move it;npm audit fixonly offers a nonsensical--forcedowngrade tolerna@6. This PR intentionally overrides that exact pin (a rootoverrides: { "tar": "^7.5.22" }) because it is a security fix. The override can be dropped once lerna ships a release with a patched pin.After this change:
npm ls tarresolves7.5.22everywhere (lerna, pacote, node-gyp, arborist) and the audit drops from 30 vulnerabilities (1 critical) to 29 (0 critical).Gates
Baseline was recorded on a clean
mastercheckout, then re-run with the update applied — no new failures:npm run format/npm run lint(biome): clean, before and afternpm run build(18 projects): green, before and afternpm run tsc(8 projects): green, before and afternpm testunit suites (vitest): all 14 suites pass, before and afterPending queue (other updates found this run)
Remaining security advisories — all transitive, 29 total (20 high, 9 moderate), most fixable via in-range lockfile refreshes in future runs:
axios(vianx),brace-expansion(many paths),fast-uri,undici,image-size(viametro),postcssuuid(via thexcode/@expo/config-pluginschain)Patch:
@chakra-ui/react3.36.0 → 3.36.1@tanstack/react-query5.101.2 → 5.101.4@types/react19.2.17 → 19.2.18@types/react-dom19.2.3 → 19.2.4@vitejs/plugin-react6.0.3 → 6.0.5@zip.js/zip.js2.8.34 → 2.8.36react/react-dom19.2.7 → 19.2.8Minor:
@playwright/test1.61.1 → 1.62.1happy-dom20.10.6 → 20.11.2reactjrx1.141.2 → 1.142.0 (Dependabot PR build(deps): bump reactjrx from 1.141.2 to 1.142.0 #302 already open)vite8.1.5 → 8.2.1 (Dependabot PR build(deps-dev): bump vite from 8.1.5 to 8.2.1 #300 already open)expo-file-system56.0.8 → 56.0.9Major (still coming — flagged for review):
typescript6.0.3 → 7.0.2@babel/core7.29.7 → 8.0.1pdfjs-dist5.7.284 → 6.2.108react-dropzone15.0.0 → 20.1.0 (Dependabot PR build(deps): bump react-dropzone from 15.0.0 to 20.0.0 #291 already open)xmldoc2.0.3 → 3.0.0expo-file-system56.x → 57.0.2Needs manual attention
Nothing this run — the chosen update passed all gates. Note the remaining
image-size/uuidadvisories sit behind theexpo/metrodependency chains and may need coordinated expo upgrades rather than single-package bumps.Generated by Claude Code