Repository navigation
Patch node-tar and other high dependency advisories - #86
Merged
Merged
Conversation
node-tar through 7.5.18 allows a denial of service (GHSA-23hp-3jrh-7fpw, critical Dependabot alert on the lockfile). The repo pins tar to 7.5.16 through a resolutions entry, so every consumer was held on the vulnerable release even though the parents already request ^7.5.21. Key changes: - bump the tar resolution from 7.5.16 to 7.5.22 - re-lock tar to 7.5.22, the only tar entry in the lockfile Related to datum-cloud/infra#6681
ecv
changed the title
ecv
marked this pull request as ready for review
October 3, 2026 02:58
Re-resolve vulnerable transitive dependencies within the version ranges their parents already declare, so the open high Dependabot alerts no longer match anything in the lockfile. No new resolutions are added and no direct dependency crosses a major version. Key changes: - Re-resolve brace-expansion, browserslist, fast-uri, immutable, ip-address, linkify-it, multer, postcss, shell-quote, svgo and js-yaml to patched releases - Refresh the Module Federation packages, which pin adm-zip and undici exactly, to the release that carries the patched versions - Refresh the AWS XML builder and swagger-ui-react, which pinned fast-xml-parser and js-yaml exactly - Drop the undici override, which no longer matches any dependency
ecv
changed the title
The broad axios range still resolved to 1.18.0 after the lockfile refresh. Re-resolve it within range so both ranges share 1.20.0. Key changes: - Merge the two axios lock entries into one at 1.20.0
privateip
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backstage ships a version of the node-tar archive library that has a known denial-of-service flaw, flagged as a critical Dependabot alert.
The project pinned the library to an old release, so this moves the pin to the patched one.
This also clears the other open high Dependabot alerts, all 34 in total, by re-resolving the lockfile within the version ranges packages already declare.
No new overrides were added, no direct dependency changed major version, and one override that nothing used any more was removed.
Notes
The pending Backstage bump (#85) does not fix these on its own, because it keeps the old pin. It also conflicts with this PR on the lockfile, so whichever lands second re-locks.
Test plan
Related to datum-cloud/infra#6681, datum-cloud/infra#6691