upgrade tar to fix vuln

rynop · Apr 16, 2019 · 4e5153b · 4e5153b
1 parent 355365e
commit 4e5153b
Show file tree

Hide file tree

Showing 3 changed files with 53 additions and 118 deletions.
diff --git a/index.js b/index.js
@@ -148,7 +148,7 @@ function installDynamoDbLocal() {
         filebuf = fs.createReadStream(Config.downloadUrl);
         filebuf
             .pipe(zlib.Unzip())
-            .pipe(tar.Extract({path: Config.installPath}))
+            .pipe(tar.extract({cwd: Config.installPath}))
             .on('end', function () {
                 deferred.resolve();
             })
@@ -165,7 +165,7 @@ function installDynamoDbLocal() {
                 }
                 redirectResponse
                     .pipe(zlib.Unzip())
-                    .pipe(tar.Extract({path: Config.installPath}))
+                    .pipe(tar.extract({cwd: Config.installPath}))
                     .on('end', function () {
                         deferred.resolve();
                     })

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "dynamodb-local",
   "description": "A wrapper for AWS DynamoDB Local, intended for use in testcases",
-  "version": "0.0.25",
+  "version": "0.0.26",
   "license": "MIT",
   "repository": "doapp-ryanp/dynamodb-local",
   "author": {
@@ -23,10 +23,10 @@
     "node": ">= 0.10.33"
   },
   "dependencies": {
-    "debug": "^4.1.0",
-    "mkdirp": "^0.5.0",
-    "q": "^1.4.1",
-    "tar": "^2.0.0"
+    "debug": "~4.1.0",
+    "mkdirp": "~0.5.0",
+    "q": "~1.4.1",
+    "tar": "~4.4.8"
   },
   "licenses": [
     {