[Snyk] Security upgrade tar from 4.4.19 to 6.2.1

vinay033 commented 3 months ago

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - components/chef-ui-library/package.json - components/chef-ui-library/package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **718/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.5 | Uncontrolled Resource Consumption ('Resource Exhaustion')
[SNYK-JS-TAR-6476909](https://snyk.io/vuln/SNYK-JS-TAR-6476909) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: tar

The new version differs by 167 commits.

c65f76d 6.2.1
ffe6824 prevent extraction in excessively deep subfolders
fe7ebfd remove security.md
5bc9d40 6.2.0
fe1ef5e changelog 6.2
e483220 get rid of npm lint stuff
689928a ci that works outside of npm org
db6f539 file inference improvements for .tbr and .tgz
336fa8f refactor: dry and other pr comments
eeba222 chore: lint fixes
c9fc57c feat: add initial support for brotli
8c5af15 silence dependabot
3302cf7 6.1.15
4501bdb Normalize unicode internally using NFD
24efc74 remove parallelism causing test/pack.js to be flaky
8cd8139 move mutateFS reset out of t.teardown
4aaffc8 6.1.14
4cbdd67 deps: minipass@5.0.0
75d3081 fix: update repository url in package.json
82bb328 chore: postinstall for dependabot template-oss PR
5f31636 chore: bump @ npmcli/template-oss from 4.10.0 to 4.11.0
a044a87 chore: release 6.1.13 (#344)
cc4e0dd deps: bump minipass from 3.3.6 to 4.0.0
5dcfcb3 chore: bump events-to-array from 1.1.2 to 2.0.3

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/vinay033/project/ac0a50b7-b0b1-4975-a803-d42f1c0da6be?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/vinay033/project/ac0a50b7-b0b1-4975-a803-d42f1c0da6be?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"b831be6a-932f-4c0e-9779-6c7502dff8f6","prPublicId":"b831be6a-932f-4c0e-9779-6c7502dff8f6","dependencies":[{"name":"tar","from":"4.4.19","to":"6.2.1"}],"packageManager":"npm","projectPublicId":"ac0a50b7-b0b1-4975-a803-d42f1c0da6be","projectUrl":"https://app.snyk.io/org/vinay033/project/ac0a50b7-b0b1-4975-a803-d42f1c0da6be?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-TAR-6476909"],"upgrade":["SNYK-JS-TAR-6476909"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[718],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Uncontrolled Resource Consumption ('Resource Exhaustion')](https://learn.snyk.io/lesson/redos/?loc=fix-pr)