From 62715425c5230c19c8c2352724fa581bb1ccf5ee Mon Sep 17 00:00:00 2001 From: sheehanmunim Date: Sat, 19 Sep 2026 14:28:39 -0400 Subject: [PATCH] fix(deps): tar 7.5.22 for project transfer archives node-tar 7.5.16 has denial-of-service bugs when parsing hostile archives (unbounded decompression, negative entry sizes, NUL bytes and numeric PAX paths, uncontrolled recursion; GHSA critical/high, fixed by 7.5.21). ProjectTransferFiles extracts archives received from another machine, so it takes the patched release. node-gyp's copy moves to 7.5.22 too. Co-Authored-By: Claude Opus 5 (1M context) --- apps/server/package.json | 2 +- pnpm-lock.yaml | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/apps/server/package.json b/apps/server/package.json index 6b3844d49a8c..cede33675edc 100644 --- a/apps/server/package.json +++ b/apps/server/package.json @@ -33,7 +33,7 @@ "node-pty": "^1.1.0", "stream-chain": "^4.2.5", "stream-json": "3.6.0", - "tar": "7.5.16", + "tar": "7.5.22", "yaml": "catalog:", "yauzl": "^3.4.0" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8770ab703fdb..f345063062f2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -536,8 +536,8 @@ importers: specifier: 3.6.0 version: 3.6.0 tar: - specifier: 7.5.16 - version: 7.5.16 + specifier: 7.5.22 + version: 7.5.22 yaml: specifier: ^2.9.0 version: 2.9.0 @@ -10447,8 +10447,8 @@ packages: resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==} engines: {node: '>=6'} - tar@7.5.16: - resolution: {integrity: sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==} + tar@7.5.22: + resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==} engines: {node: '>=18'} temp-file@3.4.0: @@ -16588,7 +16588,7 @@ snapshots: proper-lockfile: 4.1.2 resedit: 1.7.2 semver: 7.7.4 - tar: 7.5.16 + tar: 7.5.22 temp-file: 3.4.0 tiny-async-pool: 1.3.0 unzipper: 0.12.5 @@ -20411,7 +20411,7 @@ snapshots: nopt: 9.0.0 proc-log: 6.1.0 semver: 7.8.5 - tar: 7.5.16 + tar: 7.5.22 tinyglobby: 0.2.17 undici: 6.28.1 which: 6.0.1 @@ -22179,7 +22179,7 @@ snapshots: tapable@2.3.3: {} - tar@7.5.16: + tar@7.5.22: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0