fix(deps): override node-tar to ^7.5.19 (Dependabot #94-#104, 11 alerts)#3466
Merged
Conversation
#94-#104) A batch of 11 node-tar advisories (Critical->Moderate: decompression DoS, path traversal, symlink/hardlink escape, PAX parsing differentials) flagged every tar copy below 7.5.19. bun.lock had tar@6.2.1 (x5, via build tooling: node-gyp, cacache, @electron/rebuild, app-builder-lib, giget), tar@7.5.11 (fleetctl), and tar@7.5.20 (already patched). node-tar backported no fixes to the 6.x line, so the only remediation is tar >= 7.5.19. Added a bun override "tar": "^7.5.19" — bun.lock now resolves a single tar@7.5.20 for all consumers. tar@7 is a dual CJS/ESM package with a stable extract/create API, so the CJS build tools keep working via require(). Reachability was low pre-fix (all vulnerable copies were build-time tooling or trusted-source CLI extraction, none extract attacker-controlled archives in the runtime API), but the override removes the vulnerable versions entirely. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears all 11 node-tar Dependabot alerts (#94–#104) — one package, one override. Branched off
mainafter #3464 merged;bun.lockregenerated cleanly.The alerts
A batch of node-tar advisories (Critical → Moderate): decompression/parse DoS, arbitrary file create/overwrite via hardlink/symlink path traversal, drive-relative linkpath escape, PAX header interpretation differential (file smuggling), NUL-byte uncaught-exception DoS. All have no lower bound, so every tar copy
< 7.5.19was flagged.Before
bun.lockhad 4 lines of tar:tar@6.2.1×5 — build tooling:node-gyp,cacache,@electron/rebuild,app-builder-lib,gigettar@7.5.11—fleetctltar@7.5.20×2 — already patched (npm internals, trigger.dev)node-tar backported no fixes to 6.x, so the only remediation is
tar ≥ 7.5.19.Fix
Bun override
"tar": "^7.5.19"→bun.locknow resolves a singletar@7.5.20for all consumers (verified: notar@6.xor7.5.1xremain). Net -58 lines in the lockfile from dedup.Safe because tar@7 is a dual CJS/ESM package (
exportshas bothimportandrequire), so the CJS build tools thatrequire('tar')keep working, and theextract/createAPI is stable across 6→7 (Node ≥18, which we already require).Reachability
Low even pre-fix: every vulnerable copy was build-time tooling (electron packaging, native-module builds, npm cache) or trusted-source CLI extraction (fleetctl↔Fleet, trigger.dev deploy). Nothing extracts attacker-controlled archives in the runtime API. The override removes the versions entirely regardless.
The override bumps the device-agent Electron build tooling (
@electron/rebuild,app-builder-lib) and native-module builds (node-gyp) from tar 6→7. Compatibility is expected (dual package, stable API) but worth confirming the device-agent build + anynode-gypnative compiles still pass. If anything breaks, the fallback is to dismiss the build-tooling-only alerts as not-reachable.Summary by cubic
Overrides
tarto^7.5.19to clear 11 Dependabot alerts (#94–#104) and dedupe to a single patchedtar@7.5.20for all consumers.Dependencies
tar: ^7.5.19;bun.locknow resolves all usages totar@7.5.20.tar@6.xand7.5.11; addresses Critical–Moderate advisories (DoS, path traversal, link escape, PAX parsing).Migration
node-gypand Electron packaging still pass;tar@7keeps the create/extract API and supports both CJS and ESM.Written for commit 02f0594. Summary will update on new commits.