From 49c2f0435d4fc8e591c1a1663b9fce175b66b135 Mon Sep 17 00:00:00 2001 From: anupamme Date: Thu, 8 Oct 2026 19:10:39 +0000 Subject: [PATCH] fix: CVE-2026-59873 security vulnerability Automated dependency upgrade by OrbisAI Security --- package.json | 5 ++++ pnpm-lock.yaml | 76 +++++++++++++++++++++++++++++++++++++------------- 2 files changed, 61 insertions(+), 20 deletions(-) diff --git a/package.json b/package.json index 9d6a8cc..04a1097 100644 --- a/package.json +++ b/package.json @@ -40,5 +40,10 @@ }, "overrides": { "graceful-fs": "^4.2.11" + }, + "pnpm": { + "overrides": { + "tar": "7.5.21" + } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a04aa29..222df7a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + tar: 7.5.21 + importers: .: @@ -33,6 +36,10 @@ packages: '@gar/promisify@1.1.3': resolution: {integrity: sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==} + '@isaacs/fs-minipass@4.0.1': + resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} + engines: {node: '>=18.0.0'} + '@npmcli/fs@1.1.1': resolution: {integrity: sha512-8KG5RD0GVP4ydEzRn/I4BNDuxDtqVbOdm8675T49OIG/NGhaK0pjPX7ZcDlvKYbA+ulvVK3ztfcF4uBdOxuJbQ==} @@ -104,6 +111,10 @@ packages: resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==} engines: {node: '>=10'} + chownr@3.0.0: + resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==} + engines: {node: '>=18'} + clean-stack@2.2.0: resolution: {integrity: sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==} engines: {node: '>=6'} @@ -327,14 +338,18 @@ packages: resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==} engines: {node: '>=8'} - minipass@5.0.0: - resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==} - engines: {node: '>=8'} + minipass@7.1.3: + resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==} + engines: {node: '>=16 || 14 >=14.17'} minizlib@2.1.2: resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==} engines: {node: '>= 8'} + minizlib@3.1.0: + resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==} + engines: {node: '>= 18'} + mkdirp-classic@0.5.3: resolution: {integrity: sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==} @@ -500,9 +515,9 @@ packages: resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==} engines: {node: '>=6'} - tar@6.2.1: - resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==} - engines: {node: '>=10'} + tar@7.5.21: + resolution: {integrity: sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==} + engines: {node: '>=18'} tunnel-agent@0.6.0: resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==} @@ -534,11 +549,19 @@ packages: yallist@4.0.0: resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==} + yallist@5.0.0: + resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==} + engines: {node: '>=18'} + snapshots: '@gar/promisify@1.1.3': optional: true + '@isaacs/fs-minipass@4.0.1': + dependencies: + minipass: 7.1.3 + '@npmcli/fs@1.1.1': dependencies: '@gar/promisify': 1.1.3 @@ -633,7 +656,7 @@ snapshots: promise-inflight: 1.0.1(bluebird@3.7.2) rimraf: 3.0.2 ssri: 8.0.1 - tar: 6.2.1 + tar: 7.5.21 unique-filename: 1.1.1 transitivePeerDependencies: - bluebird @@ -641,7 +664,10 @@ snapshots: chownr@1.1.4: {} - chownr@2.0.0: {} + chownr@2.0.0: + optional: true + + chownr@3.0.0: {} clean-stack@2.2.0: optional: true @@ -710,6 +736,7 @@ snapshots: fs-minipass@2.1.0: dependencies: minipass: 3.3.6 + optional: true fs.realpath@1.0.0: optional: true @@ -900,17 +927,24 @@ snapshots: minipass@3.3.6: dependencies: yallist: 4.0.0 + optional: true - minipass@5.0.0: {} + minipass@7.1.3: {} minizlib@2.1.2: dependencies: minipass: 3.3.6 yallist: 4.0.0 + optional: true + + minizlib@3.1.0: + dependencies: + minipass: 7.1.3 mkdirp-classic@0.5.3: {} - mkdirp@1.0.4: {} + mkdirp@1.0.4: + optional: true ms@2.1.2: optional: true @@ -941,7 +975,7 @@ snapshots: npmlog: 6.0.2 rimraf: 3.0.2 semver: 7.6.2 - tar: 6.2.1 + tar: 7.5.21 which: 2.0.2 transitivePeerDependencies: - bluebird @@ -1074,7 +1108,7 @@ snapshots: bindings: 1.5.0 node-addon-api: 7.1.1 prebuild-install: 7.1.2 - tar: 6.2.1 + tar: 7.5.21 optionalDependencies: node-gyp: 8.4.1(bluebird@3.7.2) transitivePeerDependencies: @@ -1119,14 +1153,13 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 - tar@6.2.1: + tar@7.5.21: dependencies: - chownr: 2.0.0 - fs-minipass: 2.1.0 - minipass: 5.0.0 - minizlib: 2.1.2 - mkdirp: 1.0.4 - yallist: 4.0.0 + '@isaacs/fs-minipass': 4.0.1 + chownr: 3.0.0 + minipass: 7.1.3 + minizlib: 3.1.0 + yallist: 5.0.0 tunnel-agent@0.6.0: dependencies: @@ -1162,4 +1195,7 @@ snapshots: wrappy@1.0.2: {} - yallist@4.0.0: {} + yallist@4.0.0: + optional: true + + yallist@5.0.0: {}