Update `tar` for security
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1k
- Forks
- 44
- Avg merge
- 1d 59m
- Merged PRs (30d)
- 3
Description
The current version of tar being depended on (4.4.18) is vulnerable to GHSA-f5x3-32g6-xq36 - while it's unlikely to be exploitable in this context, it still would be good to resolve since it creates noise in security scanners.
tar 5 and 6 dropped support for Node 4, 6, and 8 but this package already only supports Node 10+ so that shouldn't be a problem.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the package manifest and lockfile entries for tar, then read the linked tar changelog with the project's Node 10+ support requirement in mind. Update the dependency to a supported non-vulnerable release, refresh dependency metadata, and verify that the security scanner no longer reports GHSA-f5x3-32g6-xq36.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100