kevva / kevva/decompress

Increase decompress-tar version when decompress-tar upgrades tar-stream

Open
#80 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
419
Forks
55
PR merge metrics
No merged PRs in 30d

Description

[`decompress-tar@4.1.1` depends on `tar-stream@1.6.2`](https://github.com/kevva/decompress-tar/issues/14), which depends on [`bl@1.2.3`, which has a security advisory](https://nvd.nist.gov/vuln/detail/CVE-2020-8244).

Please upgrade the `decompress-tar` dependency when `decompress-tar` releases a new version.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by checking the dependency metadata for decompress-tar and whether a newer release is available. Done means updating the dependency when that release exists and confirming the dependency graph no longer includes the vulnerable tar-stream/bl versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
security, tooling
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.