fix: upgrade to tar@7.5.6 #1228
Conversation
- upgrades tar to latest release to resolve security vulnerability - changed to namespace import to match new tar@7 export style - removed @types/tar, as types are built-in now https://github.com/isaacs/node-tar/commits/v7.5.3 chore(deps): tar@7.5.4 https://github.com/isaacs/node-tar/commits/v7.5.4 revert lockfile changes update to latest Co-authored-by: Avi Vahl <avi@vahl.co.il>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
yarn.lock
Outdated
| bin: | ||
| mkdirp: bin/cmd.js | ||
| checksum: 10c0/46ea0f3ffa8bc6a5bc0c7081ffc3907777f0ed6516888d40a518c5111f8366d97d2678911ad1a6882bf592fa9de6c784fea32e1687bb94e1f4944170af48a5cf | ||
| "minizlib@npm:^3.1.0": |
There was a problem hiding this comment.
Now we have two minizlib v3.0.2 & v3.1.0. Could it be deduplicated?
|
Something went wrong and the release was not produced |
|
@AlimovSV yeah, there needs to be some fix with our GitHub infrastructure permissions. Please hold! |
|
Bump where we're at with publishing the release? It seems this is holding up quite a few downstream consumers; particularly electron-userland/electron-builder#9518 (and potentially electron/llm?). Are we waiting on something else to be merged or is it just the GitHub infrastructure issue? |
|
🎉 This PR is included in version 4.0.3 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
@nyoma-diamond, the release was being blocked by some overzealous security rules in our GitHub infrastructure - we've resolved that issue and the v4.0.3 release of |
Addresses https://nvd.nist.gov/vuln/detail/CVE-2026-23745. Note that this wasn't backported to tar@6 so this PR has a major version bump to tar@7.
I took #1226 and regenerated the lockfile changes myself after running
git checkout main yarn.lock. Everything was squash rebased into a single commit under my signature.Note that this required me to temporarily bypass the
npmMinimalAgeGatesetting.