deps: tar@7.5.22

node_modules/tar/dist/commonjs/list.js

@@ -59,14 +59,22 @@ const onReadEntryFunction = (opt) => {
 const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [(0, strip_trailing_slashes_js_1.stripTrailingSlashes)(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || (0, path_1.parse)(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root);
+            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;

node_modules/tar/dist/commonjs/parse.js

@@ -376,6 +376,16 @@ class Parser extends events_1.EventEmitter {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode

node_modules/tar/dist/esm/list.js

@@ -20,14 +20,22 @@ const onReadEntryFunction = (opt) => {
 export const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [stripTrailingSlashes(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || parse(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas(dirname(file), root);
+            ret = m !== undefined ? m : mapHas(dirname(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;

node_modules/tar/dist/esm/parse.js

@@ -373,6 +373,16 @@ export class Parser extends EE {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode

node_modules/tar/package.json

@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter",
   "name": "tar",
   "description": "tar for node",
-  "version": "7.5.19",
+  "version": "7.5.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"

package-lock.json

@@ -142,7 +142,7 @@
         "spdx-expression-parse": "^4.0.0",
         "ssri": "^13.0.1",
         "supports-color": "^10.2.2",
-        "tar": "^7.5.19",
+        "tar": "^7.5.22",
         "text-table": "~0.2.0",
         "tiny-relative-date": "^2.0.2",
         "treeverse": "^3.0.0",
@@ -13228,9 +13228,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.19",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.19.tgz",
-      "integrity": "sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "inBundle": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {

package.json

@@ -110,7 +110,7 @@
     "spdx-expression-parse": "^4.0.0",
     "ssri": "^13.0.1",
     "supports-color": "^10.2.2",
-    "tar": "^7.5.19",
+    "tar": "^7.5.22",
     "text-table": "~0.2.0",
     "tiny-relative-date": "^2.0.2",
     "treeverse": "^3.0.0",