From 8ddd19ced52da34379e872897708d8bc2cacad16 Mon Sep 17 00:00:00 2001 From: Dread Date: Wed, 22 Jul 2026 17:49:34 -0700 Subject: [PATCH] fix(deps): bump tar resolution to 7.5.19 for critical audit advisory yarn audit now flags a critical DoS advisory in tar (<7.5.19, npmjs.com/advisories/1123940, pulled in via @apollo/rover > binary-install), which fails the CI Audit gate for every PR. Bump the existing **/tar resolution from 7.5.11 to the patched 7.5.19. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01UXnQYUbKQe5wUCWEvdAau7 --- package.json | 2 +- yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index a82472663..8d366cb15 100644 --- a/package.json +++ b/package.json @@ -218,7 +218,7 @@ "**/node-forge": "1.4.0", "**/path-to-regexp": "0.1.13", "**/qs": "6.15.1", - "**/tar": "7.5.11", + "**/tar": "7.5.19", "**/picomatch": "2.3.2", "**/follow-redirects": "1.16.0", "**/js-yaml": "4.1.1", diff --git a/yarn.lock b/yarn.lock index a2c0d614f..4d189dd80 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13411,10 +13411,10 @@ tapable@^2.2.0: resolved "https://registry.yarnpkg.com/tapable/-/tapable-2.3.0.tgz#7e3ea6d5ca31ba8e078b560f0d83ce9a14aa8be6" integrity sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg== -tar@7.5.11, tar@^6.1.11: - version "7.5.11" - resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.11.tgz#1250fae45d98806b36d703b30973fa8e0a6d8868" - integrity sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ== +tar@7.5.19, tar@^6.1.11: + version "7.5.19" + resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.19.tgz#d8915e6b717f8036a79d839ca9448198b002b0a7" + integrity sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw== dependencies: "@isaacs/fs-minipass" "^4.0.0" chownr "^3.0.0"