fix(deps): bump tar override to 7.5.10 (GHSA-qffp-2rhf-9h96)#280
Merged
marcusrbrown merged 2 commits intomainfrom Mar 8, 2026
Merged
fix(deps): bump tar override to 7.5.10 (GHSA-qffp-2rhf-9h96)#280marcusrbrown merged 2 commits intomainfrom
marcusrbrown merged 2 commits intomainfrom
Conversation
…9h96 Co-authored-by: marcusrbrown <831617+marcusrbrown@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix open Dependabot security alert
fix(deps): bump tar override to 7.5.10 (GHSA-qffp-2rhf-9h96)
Mar 7, 2026
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot alert #27:
tar≤ 7.5.9 allows hardlink path traversal via drive-relative linkpaths, enabling arbitrary file writes outside the extraction root (high severity, CVE-2026-29786).Change
Bumps the
pnpm.overridespin fortarfrom the vulnerable7.5.9to the patched7.5.10. Lockfile updated accordingly.Original prompt
This section details on the original issue you should resolve
<issue_title>Daily Maintenance Report</issue_title>
<issue_description>## 2026-03-07 (UTC)
Summary Metrics
Stale Issues (no activity >30 days)
No stale issues. 2 open issues (#252, #2); both active within the last 2 days.
Stale PRs (no activity >7 days / >14 days)
No open PRs.
Unassigned Bugs
No open issues with the
buglabel.Recommended Actions
tarHardlink Path Traversal via Drive-Relative Linkpath (high severity, opened 2026-03-06 — unresolved for 2 days)Notes
tarHardlink Path Traversal — still open (high severity, day 2)2026-03-06 (UTC)
Summary Metrics
Stale Issues (no activity >30 days)
No stale issues. 3 open issues (#252, #200, #2); #200 last active 2026-02-16 (18 days — 12 days from stale threshold).
Stale PRs (no activity >7 days / >14 days)
No open PRs.
Unassigned Bugs
No open issues with the
buglabel.Recommended Actions
tarHardlink Path Traversal via Drive-Relative Linkpath (high severity, opened 2026-03-06)Notes
tarHardlink Path Traversal via Drive-Relative Linkpath (high severity)2026-03-05 (UTC)
Summary Metrics
Stale Issues (no activity >30 days)
No stale issues. 3 open issues (#252, #200, #2); #200 last active 2026-02-16 (17 days — approaching 30-day threshold).
Stale PRs (no activity >7 days / >14 days)
No open PRs.
Unassigned Bugs
No open issues with the
buglabel.Recommended Actions
Notes
2026-03-04 (UTC)
Summary Metrics
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.