From b2b95200c6a393d51bede4d432df55a884e8aa3b Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Thu, 13 Aug 2026 11:31:03 -0500 Subject: [PATCH] fix: bump node-tar from 7.5.11 to 7.5.22 to resolve dependabot alerts Fixes 5 open dependabot alerts (CVEs) including a critical decompression DoS and a high-severity infinite loop vulnerability. Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- cloud-shell/package.json | 2 +- cloud-shell/yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/cloud-shell/package.json b/cloud-shell/package.json index 5341b42c..f17c940a 100644 --- a/cloud-shell/package.json +++ b/cloud-shell/package.json @@ -28,7 +28,7 @@ "resolutions": { "cipher-base": "^1.0.6", "sha.js": "^2.4.12", - "tar": "7.5.11", + "tar": "7.5.22", "minimatch@^3.1.1": "^3.1.5", "minimatch@^10.1.1": "^10.2.4", "ajv": "6.14.0", diff --git a/cloud-shell/yarn.lock b/cloud-shell/yarn.lock index 890196f5..703e007e 100644 --- a/cloud-shell/yarn.lock +++ b/cloud-shell/yarn.lock @@ -4057,16 +4057,16 @@ __metadata: languageName: node linkType: hard -"tar@npm:7.5.11": - version: 7.5.11 - resolution: "tar@npm:7.5.11" +"tar@npm:7.5.22": + version: 7.5.22 + resolution: "tar@npm:7.5.22" dependencies: "@isaacs/fs-minipass": "npm:^4.0.0" chownr: "npm:^3.0.0" minipass: "npm:^7.1.2" minizlib: "npm:^3.1.0" yallist: "npm:^5.0.0" - checksum: 10c0/b6bb420550ef50ef23356018155e956cd83282c97b6128d8d5cfe5740c57582d806a244b2ef0bf686a74ce526babe8b8b9061527623e935e850008d86d838929 + checksum: 10c0/1311f6be85a8157ac4c9147bae43e13923d2a1aae15e4aa1bd5239e4e03d2cf53cfe103dde7f35832fbb4c938b042856bc8e9a0afd29abd05e2d1608788c4fea languageName: node linkType: hard