Skip to content

chore(deps): Update tar override to 7.5.7 to address vulnerability CVE-2026-24842#308

Merged
Artmann merged 3 commits intomainfrom
chris/fix-tar-vur
Jan 30, 2026
Merged

chore(deps): Update tar override to 7.5.7 to address vulnerability CVE-2026-24842#308
Artmann merged 3 commits intomainfrom
chris/fix-tar-vur

Conversation

@Artmann
Copy link
Contributor

@Artmann Artmann commented Jan 30, 2026

Summary by CodeRabbit

  • Security

    • Added a new vulnerability advisory entry to the repository configuration.
  • Chores

    • Pinned tar package to version 7.5.7 to standardize resolution across installs.

✏️ Tip: You can customize this high-level summary in your review settings.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Jan 30, 2026

📝 Walkthrough

Walkthrough

Replaces the package.json overrides entry "tar@<7.5.4": "7.5.4" with a direct "tar": "7.5.7" override, changing tar resolution to an exact 7.5.7 version. Adds a new vulnerability entry "GHSA-p5wg-g6qr-c7cg" (with notes and expiry) to the top-level object in .nsprc, inserting the new key-value pair alongside existing entries.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: updating the tar dependency override from 7.5.4 to 7.5.7 to address a specific vulnerability.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov
Copy link

codecov bot commented Jan 30, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0%. Comparing base (e8b41be) to head (f460c64).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@     Coverage Diff     @@
##   main   #308   +/-   ##
===========================
===========================
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai[bot]
coderabbitai bot previously approved these changes Jan 30, 2026
Stack Overflow in RuleTester.run() when serializing objects with
circular references. Accepted risk: dev-only dependency, requires
local access and user interaction, only affects test authoring.
@Artmann Artmann marked this pull request as ready for review January 30, 2026 14:36
@Artmann Artmann requested a review from a team as a code owner January 30, 2026 14:36
@Artmann Artmann merged commit 8b6c018 into main Jan 30, 2026
11 checks passed
@Artmann Artmann deleted the chris/fix-tar-vur branch January 30, 2026 14:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants