OCPBUGS-98314: bump tar to ^7.5.19 for CVE-2026-59873#16745
Conversation
node-tar <7.5.19 is vulnerable to a Denial of Service via crafted gzip bomb (CVE-2026-59873). Add a yarn resolution to force the fixed version. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/severity-important
|
@Cragsmann: This pull request references Jira Issue OCPBUGS-98314, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughChangesDependency resolution
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@Cragsmann: This pull request references Jira Issue OCPBUGS-98314, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Cragsmann The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Line 340: Pin the tar dependency in frontend/package.json to the exact version
7.5.19 by removing the caret prefix, matching the exact-version convention used
by fast-uri.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e7e3b405-aa20-4406-bf7c-427cd70c19f4
⛔ Files ignored due to path filters (1)
frontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
frontend/package.json
| "protobufjs": "7.5.8", | ||
| "fast-uri": "3.1.2" | ||
| "fast-uri": "3.1.2", | ||
| "tar": "^7.5.19" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Pin tar to an exact version instead of using a caret range.
The path instructions for package*.json files require pinning exact versions. The caret range ^7.5.19 allows any future 7.x release, which could introduce new vulnerabilities. The existing fast-uri resolution in the same block already uses an exact pin (3.1.2), so this should be consistent.
🔒 Proposed fix to pin exact version
- "tar": "^7.5.19"
+ "tar": "7.5.19"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "tar": "^7.5.19" | |
| "tar": "7.5.19" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/package.json` at line 340, Pin the tar dependency in
frontend/package.json to the exact version 7.5.19 by removing the caret prefix,
matching the exact-version convention used by fast-uri.
Source: Path instructions
|
@Cragsmann: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Analysis / Root cause:
CVE-2026-59873:
node-tarprior to 7.5.19 does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio, allowing a small crafted gzip bomb to exhaust disk space and CPU.Our
yarn.lockpinnedtar@7.5.7via thenode-gypbuild dependency. While this is a build-time only dependency (not shipped in the container image), it triggers security scanner findings against theose-console-rhel9image.Jira: https://redhat.atlassian.net/browse/OCPBUGS-98314
Solution description:
Add a yarn
resolutionsentry for"tar": "^7.5.19"infrontend/package.jsonto force the patched version. This follows the established pattern used for other CVE bumps (protobufjs, fast-uri, shell-quote, etc.).Screenshots / screen recording:
N/A — dependency-only change, no UI impact.
Test setup:
No special setup required.
Test cases:
yarn installcompletes without errorsyarn why tarshows7.5.19+Browser conformance:
Additional info:
The
tarpackage is only used at build time bynode-gypfor compiling native addons (fsevents, nan, websocket). It is never included in the production bundle or container image.Reviewers and assignees:
Summary by CodeRabbit
tarpackage.fast-uri.