From a782b5699889341a0d6aaeadc623f52aba323e30 Mon Sep 17 00:00:00 2001 From: Aaron Sachs <898627+asachs01@users.noreply.github.com> Date: Fri, 28 Aug 2026 07:25:18 +0000 Subject: [PATCH] fix(deps): close GHSA-r292-9mhp-454m (node-tar recursion DoS) Bundled tar (via the npm CLI devDependency, transitively pulled in by @semantic-release/npm) was at 7.5.19/7.5.20, short of the 7.5.21 patch for the uncontrolled-recursion stack-overflow DoS. Verified before acting per the caution the task flagged: npm audit's suggested "semantic-release@24.2.9" remediation was a red herring (older than the already-resolved 25.0.3, unaffected). A plain `npm audit fix` (no --force) re-resolves npm to 11.19.1 within its existing declared range -- lockfile-only, no package.json change, no semver-major bump. Also clears 2 previously-noted moderate advisories (brace-expansion, ip-address) that an older changelog entry said needed a breaking --force change; they don't anymore. npm audit now reports 0 vulnerabilities. Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 3 ++- package-lock.json | 22 +++++++++++----------- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e9c311bf..08703a26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,7 +18,8 @@ ### Security -- `npm audit fix` cleared 2 of 4 moderate advisories. The remaining 2 (`brace-expansion`, `ip-address`) live in the bundled `npm` CLI pulled in transitively and require a breaking `--force` change to resolve. +- **Closed GHSA-r292-9mhp-454m (node-tar uncontrolled recursion, high, stack-overflow DoS via crafted long-path tar).** Bundled `tar` (pulled in transitively via the `npm` CLI devDependency, itself pulled in via `@semantic-release/npm`) was at 7.5.19/7.5.20, just short of the 7.5.21 patch. A plain `npm audit fix` (no `--force`) re-resolved `npm` to 11.19.1 (bundled tar 7.5.22) within the existing declared range — lockfile-only change, no `package.json`/direct-dependency edits, no semver-major bump. `npm audit`'s own suggested remediation path (`semantic-release@24.2.9`, flagged `isSemVerMajor`) was a red herring — the currently-resolved `semantic-release` (25.0.3, newer than that suggestion) was never at risk and is unchanged by this fix. +- Correcting the note above (added 2026-05-20): the 2 remaining moderate advisories it described as needing a breaking `--force` change (`brace-expansion`, `ip-address`) are also resolved now — same non-force `npm audit fix`, same transitive-`npm`-CLI path. `npm audit` reports 0 vulnerabilities as of this change. ## [2.2.1] - 2026-04-28 diff --git a/package-lock.json b/package-lock.json index acce3658..71277802 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10041,9 +10041,9 @@ } }, "node_modules/npm": { - "version": "11.19.0", - "resolved": "https://registry.npmjs.org/npm/-/npm-11.19.0.tgz", - "integrity": "sha512-SDd/hHg3KqHE5Ht2NHWxNYNtqCQ2pXAPLl6OtQhPyED5PHsRfrOtO199MZTIG2cQoQ1ZRI9t28shrD+2cr3AAw==", + "version": "11.19.1", + "resolved": "https://registry.npmjs.org/npm/-/npm-11.19.1.tgz", + "integrity": "sha512-ztsxKxt/kkIaAs+2i0GU6I+DRmUdrNasxTZKJe9TCdSjKxlhah/4r/hl5ygMD6XAg1qZ9c2TNomR4qgOydp10g==", "bundleDependencies": [ "@isaacs/string-locale-compare", "@npmcli/arborist", @@ -10151,7 +10151,7 @@ "libnpmexec": "^10.3.2", "libnpmfund": "^7.0.26", "libnpmorg": "^8.0.1", - "libnpmpack": "^9.1.12", + "libnpmpack": "^9.1.13", "libnpmpublish": "^11.2.0", "libnpmsearch": "^9.0.1", "libnpmteam": "^8.0.2", @@ -10180,7 +10180,7 @@ "spdx-expression-parse": "^4.0.0", "ssri": "^13.0.1", "supports-color": "^10.2.2", - "tar": "^7.5.19", + "tar": "^7.5.22", "text-table": "~0.2.0", "tiny-relative-date": "^2.0.2", "treeverse": "^3.0.0", @@ -10645,7 +10645,7 @@ } }, "node_modules/npm/node_modules/brace-expansion": { - "version": "5.0.7", + "version": "5.0.9", "dev": true, "inBundle": true, "license": "MIT", @@ -10653,7 +10653,7 @@ "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/npm/node_modules/cacache": { @@ -10937,7 +10937,7 @@ } }, "node_modules/npm/node_modules/ip-address": { - "version": "10.2.0", + "version": "10.5.0", "dev": true, "inBundle": true, "license": "MIT", @@ -11086,7 +11086,7 @@ } }, "node_modules/npm/node_modules/libnpmpack": { - "version": "9.1.12", + "version": "9.1.13", "dev": true, "inBundle": true, "license": "ISC", @@ -11796,7 +11796,7 @@ } }, "node_modules/npm/node_modules/tar": { - "version": "7.5.19", + "version": "7.5.22", "dev": true, "inBundle": true, "license": "BlueOak-1.0.0", @@ -11892,7 +11892,7 @@ } }, "node_modules/npm/node_modules/undici": { - "version": "6.27.0", + "version": "6.28.0", "dev": true, "inBundle": true, "license": "MIT",