Conversation
Adds `tar` as a development dependency on a recent version, to workaround security issues with older `tar` transitively added through `semantic-release`
AlexAxthelm
requested review from
Copilot and
jdhoffa
and removed request for
Copilot
Expected version change and release notes:1.11.0-dev.4 (v1.11.0-dev.3...deps-security ) (2026-02-10T13:37 UTC)Build System
|
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://proud-glacier-0f640931e-715.westus2.2.azurestaticapps.net |
There was a problem hiding this comment.
Pull request overview
Updates the project’s Node.js dependency tree to address security warnings, primarily by introducing a newer tar version and refreshing the lockfile.
Changes:
- Add
tar@^7.5.7as a devDependency to mitigate vulnerable transitivetarusage. - Regenerate
package-lock.json, updating a large set of transitive dependencies (includingnpmand its bundled deps).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds tar as an explicit devDependency to influence dependency resolution for security remediation. |
| package-lock.json | Updates resolved dependency graph to include tar@7.5.7 and refreshes many transitive packages. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "tailwindcss": "^4.1.7", | ||
| "tar": "^7.5.7", | ||
| "ts-node": "^10.9.2", |
There was a problem hiding this comment.
Adding tar as a top-level devDependency doesn’t ensure all transitive/bundled tar copies get upgraded. The lockfile still includes other tar versions (e.g., npm bundles its own tar), so if the goal is to eliminate a specific vulnerable transitive tar, consider using overrides (or bumping the upstream package that brings tar) and then regenerating the lockfile to verify only the intended version remains.
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://proud-glacier-0f640931e-715.westus2.2.azurestaticapps.net |
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://proud-glacier-0f640931e-715.westus2.2.azurestaticapps.net |
1 participant
Adds
taras a development dependency on a recent version, toworkaround security issues with older
tartransitively added throughsemantic-releaseUpdates dependencies that are outdated and throwing security warnings