chore(security): bump transitive node-tar to >=7.5.11 (clear 6 high advisories)#1498
Merged
Merged
Conversation
…dvisories) `sqlite3` (an optional peer driver in `driver-sql`, build script pnpm-ignored) pulled `tar@6.2.1` via its node-gyp toolchain, tripping 6 high-severity node-tar path-traversal/symlink advisories — which failed the `pnpm audit --audit-level=high` "Validate Dependencies" gate. Adds a scoped pnpm override `"tar@>=2.0.0 <7.5.11": "^7.5.11"` so every vulnerable node-tar resolves to a patched 7.5.x+ (the ancient unrelated `tar@1.1.11` line is deliberately excluded by the `>=2.0.0` lower bound). Verified: `pnpm audit --audit-level=high` → exit 0 (0 high / 0 critical; 2 low + 5 moderate remain, below the gate); `pnpm install --frozen-lockfile` clean; `@objectstack/driver-sql` build + 132 tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears the Validate Dependencies gate (
pnpm audit --audit-level=high), which was red onmainwith 6 high-severity advisories — all the same dependency,node-tar@6.2.1, pulled transitively bysqlite3's node-gyp toolchain (driver-sql→sqlite3→ … →tar).sqlite3is only an optional peer ofdriver-sql(the real sqlite driver isbetter-sqlite3) and its build script is pnpm-ignored, so the vulnerabletarwas never executed — but the audit gate flags it regardless.Fix
Scoped
pnpm.override:node-tar(6.2.1) to a patched 7.5.x+ — patched versions (7.5.15,7.9.0) already resolved elsewhere in the tree.>=2.0.0lower bound deliberately leaves the unrelated ancienttar@1.1.11(a different package line) untouched.Advisories cleared: GHSA-34x7-hfp2-rc4v, -8qq5-rm4j-mr97, -83g3-92jg-28cx, -qffp-2rhf-9h96, -9ppj-qmqm-q256, -r6q2-hw4h-h46w.
Verification
pnpm audit --audit-level=high→ exit 0 (0 high / 0 critical; 2 low + 5 moderate remain, below the gate threshold).pnpm install --frozen-lockfile→ clean;check-changeset-fixed.mjs→ in sync.tar@6.2.1no longer in the lockfile;tar@1.1.11preserved.@objectstack/driver-sqlbuild + 132 tests pass.Lockfile/override-only; no published package code changes (empty changeset).
🤖 Generated with Claude Code