fix(security): Fixed security issue with tar dependency find with SNYK

npm / cacache

npm's content-addressable cache

Other

280 stars 31 forks source link

fix(security): Fixed security issue with tar dependency find with SNYK #268

Closed jebarpg closed 7 months ago

jebarpg commented 7 months ago

✗ Uncontrolled Resource Consumption ('Resource Exhaustion') [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-TAR-6476909] in tar@6.2.0 introduced by @npmcli/arborist@7.5.0 > cacache@18.0.2 > tar@6.2.0 and 101 other path(s) This issue was fixed in versions: 6.2.1

This was found with SNYK, thus updated tar to latest version and ran test.

References

wraithgar commented 7 months ago

The current semver range of ^6.1.11 for tar allows for users to patch this fix on their own.