npm audit vulnerability in tar

[starpit]

npm install results in audit errors:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Overwrite                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ tar                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.4.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ lerna [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ lerna > @lerna/add > @lerna/bootstrap > @lerna/run-lifecycle │
│               │ > npm-lifecycle > node-gyp > tar                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/803                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

this seems to emanate here: npm/npm-lifecycle#28

Expected Behavior

Current Behavior

Possible Solution

Steps to Reproduce (for bugs)

1. npm install

lerna.json

<!-- Please paste your `lerna.json` here -->

lerna-debug.log

<!-- If you have a `lerna-debug.log` available, please paste it here -->
<!-- Otherwise, feel free to delete this <details> block -->

Context

Your Environment

Executable	Version
lerna --version	3.13.2
npm --version	6.4.1
yarn --version	n/a
node --version	v10.15.3

OS	Version
NAME	VERSION

[evocateur]

This has been fixed upstream, awaiting release. Closing as it is not a lerna issue.

[pcowgill]

FYI here's the fix in npm-lifecycle npm/npm-lifecycle#34

[rbuckton]

There's been no activity from the npm team on npm/npm-lifecycle#34 in almost a week. @zkochan mentioned that he put together a fork of npm-lifecycle that has this fix. Is the lerna team planning to wait on npm/npm-lifecycle#34 or use https://github.com/zkochan/lifecycle in the near future?

[evocateur]

fixed in v2.1.1 of npm-lifecycle: npm/npm-lifecycle@e96f550

[ktalebian]

When can we expect @lerna/run-lifecycle to bump npm-lifecycle?

[evocateur]

`npm i -D lerna@latest`

…

On May 8, 2019, at 14:55, Kousha Talebian ***@***.***> wrote: When can we expect @lerna/run-lifecycle to bump npm-lifecycle? — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or mute the thread.