Increase decompress-tar version when decompress-tar upgrades tar-stream
Open
- Dominant language
- JavaScript
- Stars
- 419
- Forks
- 55
- PR merge metrics
- No merged PRs in 30d
Description
[`decompress-tar@4.1.1` depends on `tar-stream@1.6.2`](https://github.com/kevva/decompress-tar/issues/14), which depends on [`bl@1.2.3`, which has a security advisory](https://nvd.nist.gov/vuln/detail/CVE-2020-8244).
Please upgrade the `decompress-tar` dependency when `decompress-tar` releases a new version.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by checking the dependency metadata for decompress-tar and whether a newer release is available. Done means updating the dependency when that release exists and confirming the dependency graph no longer includes the vulnerable tar-stream/bl versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100