From 7c0207871962b64322dd51df06e39824e45e2612 Mon Sep 17 00:00:00 2001 From: indexzero Date: Sun, 18 Jan 2026 01:05:27 -0500 Subject: [PATCH] fix(supply-chain): CVE-2026-23745 upgrade node-tar to 7.5.3 node-tar <= 7.5.2 fails to sanitize linkpath for hardlinks and symlinks, allowing malicious tarballs to escape the extraction directory via path traversal. Override all transitive tar dependencies to >= 7.5.3 and add tar to minimum-release-age-exclude since the patch was just released. Co-Authored-By: Claude Opus 4.5 --- .npmrc | 1 + package.json | 5 ++++ pnpm-lock.yaml | 81 ++++++++------------------------------------------ 3 files changed, 18 insertions(+), 69 deletions(-) diff --git a/.npmrc b/.npmrc index b498180..f10f592 100644 --- a/.npmrc +++ b/.npmrc @@ -1 +1,2 @@ minimum-release-age=2890 +minimum-release-age-exclude[]=tar diff --git a/package.json b/package.json index 7ecc83f..8e4683d 100644 --- a/package.json +++ b/package.json @@ -87,6 +87,11 @@ "@yarnpkg/core": "^4.5.0" }, "packageManager": "pnpm@10.25.0", + "pnpm": { + "overrides": { + "tar": ">=7.5.3" + } + }, "engines": { "node": ">=22" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5182a1b..cfe36e5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + tar: '>=7.5.3' + importers: .: @@ -865,10 +868,6 @@ packages: chownr@1.1.4: resolution: {integrity: sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==} - chownr@2.0.0: - resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==} - engines: {node: '>=10'} - chownr@3.0.0: resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==} engines: {node: '>=18'} @@ -1215,10 +1214,6 @@ packages: fs-constants@1.0.0: resolution: {integrity: sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==} - fs-minipass@2.1.0: - resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==} - engines: {node: '>= 8'} - fs-minipass@3.0.3: resolution: {integrity: sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==} engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0} @@ -1869,18 +1864,10 @@ packages: resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==} engines: {node: '>=8'} - minipass@5.0.0: - resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==} - engines: {node: '>=8'} - minipass@7.1.2: resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==} engines: {node: '>=16 || 14 >=14.17'} - minizlib@2.1.2: - resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==} - engines: {node: '>= 8'} - minizlib@3.1.0: resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==} engines: {node: '>= 18'} @@ -2538,16 +2525,8 @@ packages: resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==} engines: {node: '>=6'} - tar@6.2.1: - resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==} - engines: {node: '>=10'} - - tar@7.5.1: - resolution: {integrity: sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==} - engines: {node: '>=18'} - - tar@7.5.2: - resolution: {integrity: sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==} + tar@7.5.3: + resolution: {integrity: sha512-ENg5JUHUm2rDD7IvKNFGzyElLXNjachNLp6RaGf4+JOgxXHkqA+gq81ZAMCUmtMtqBsoU62lcp6S27g1LCYGGQ==} engines: {node: '>=18'} test-exclude@7.0.1: @@ -2996,7 +2975,7 @@ snapshots: semver: 7.7.3 ssri: 13.0.0 table: 6.9.0 - tar: 7.5.1 + tar: 7.5.3 treeverse: 3.0.0 uuid: 11.1.0 walk-up-path: 4.0.0 @@ -3608,7 +3587,7 @@ snapshots: p-limit: 2.3.0 semver: 7.7.3 strip-ansi: 6.0.1 - tar: 6.2.1 + tar: 7.5.3 tinylogic: 2.0.0 treeify: 1.1.0 tslib: 2.8.1 @@ -3851,7 +3830,7 @@ snapshots: minipass-pipeline: 1.2.4 p-map: 7.0.4 ssri: 12.0.0 - tar: 7.5.2 + tar: 7.5.3 unique-filename: 4.0.0 optional: true @@ -3962,9 +3941,6 @@ snapshots: chownr@1.1.4: optional: true - chownr@2.0.0: - optional: true - chownr@3.0.0: optional: true @@ -4335,11 +4311,6 @@ snapshots: fs-constants@1.0.0: {} - fs-minipass@2.1.0: - dependencies: - minipass: 3.3.6 - optional: true - fs-minipass@3.0.3: dependencies: minipass: 7.1.2 @@ -5174,17 +5145,8 @@ snapshots: yallist: 4.0.0 optional: true - minipass@5.0.0: - optional: true - minipass@7.1.2: {} - minizlib@2.1.2: - dependencies: - minipass: 3.3.6 - yallist: 4.0.0 - optional: true - minizlib@3.1.0: dependencies: minipass: 7.1.2 @@ -5239,7 +5201,7 @@ snapshots: nopt: 8.1.0 proc-log: 5.0.0 semver: 7.7.3 - tar: 7.5.2 + tar: 7.5.3 tinyglobby: 0.2.15 which: 5.0.0 transitivePeerDependencies: @@ -5255,7 +5217,7 @@ snapshots: nopt: 9.0.0 proc-log: 6.1.0 semver: 7.7.3 - tar: 7.5.2 + tar: 7.5.3 tinyglobby: 0.2.15 which: 6.0.0 transitivePeerDependencies: @@ -5450,7 +5412,7 @@ snapshots: promise-retry: 2.0.1 sigstore: 4.1.0 ssri: 13.0.0 - tar: 7.5.2 + tar: 7.5.3 transitivePeerDependencies: - supports-color optional: true @@ -5997,26 +5959,7 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 - tar@6.2.1: - dependencies: - chownr: 2.0.0 - fs-minipass: 2.1.0 - minipass: 5.0.0 - minizlib: 2.1.2 - mkdirp: 1.0.4 - yallist: 4.0.0 - optional: true - - tar@7.5.1: - dependencies: - '@isaacs/fs-minipass': 4.0.1 - chownr: 3.0.0 - minipass: 7.1.2 - minizlib: 3.1.0 - yallist: 5.0.0 - optional: true - - tar@7.5.2: + tar@7.5.3: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0