Conversation
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.1 to 7.5.9. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.1...v7.5.9) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Free Tier Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| tar@7.5.1: | ||
| resolution: {integrity: sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==} | ||
| engines: {node: '>=18'} | ||
| deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me |
There was a problem hiding this comment.
tar not actually bumped, remains at vulnerable 7.5.1
High Severity
The PR claims to bump tar from 7.5.1 to 7.5.9 to fix security vulnerabilities, but the lockfile still resolves tar@7.5.1. No tar@7.5.9 entry exists anywhere in the lockfile. The only change to the tar entry is the addition of a deprecated field, which itself warns that old versions "contain widely publicized security vulnerabilities." The vulnerable version is pulled in as a transitive dependency of @tailwindcss/oxide@4.1.13. Meanwhile, several unrelated dependency bumps (@health-samurai/react-components, @atomic-ehr/codegen, etc.) were included without being mentioned in the PR description.
Additional Locations (1)
|
Dependabot doesn't support the 'updating transitive dependencies' feature for pnpm package_manager. Because of this, Dependabot cannot update this pull request. |
2 similar comments
|
Dependabot doesn't support the 'updating transitive dependencies' feature for pnpm package_manager. Because of this, Dependabot cannot update this pull request. |
|
Dependabot doesn't support the 'updating transitive dependencies' feature for pnpm package_manager. Because of this, Dependabot cannot update this pull request. |
Bumps tar from 7.5.1 to 7.5.9.
Commits
1f0c2c97.5.9fbb0851build minified version as default export6b8eba07.5.82cb1120fix(unpack): improve UnpackSync symlink error "into" path accuracyd18e4e1fix: do not write linkpaths through symlinks4a37eb97.5.7f4a7aa9fix: properly sanitize hard links containing ..394ece67.5.67d4cc17fix race puting a Link ahead of its target File26ab9047.5.5Maintainer changes
This version was pushed to npm by isaacs, a new releaser for tar since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Dependency updates may change generated types and UI component behavior at runtime, though no application code is modified. Risk is mainly around build/codegen output drift and subtle UI regressions from
@health-samurai/react-componentsbump.Overview
Updates
pnpm-lock.yamlto bump@health-samurai/react-componentsfrom0.0.0-alpha.12to0.0.0-alpha.13.Also upgrades dev tooling
@atomic-ehr/codegento a newer canary, pulling in newer@atomic-ehr/fhir-canonical-manager/@atomic-ehr/fhirschemaand reshaping its transitive deps (e.g., addsmustache, drops@inquirer/*/ora/handlebars/ajv, updatesyaml).No
tarversion bump is reflected in the lockfile (still7.5.1), but its entry now includes a deprecation warning.Written by Cursor Bugbot for commit 86d783c. This will update automatically on new commits. Configure here.