[Snyk] Upgrade tar from 6.2.0 to 6.2.1

[maidul98]

Snyk has created this PR to upgrade tar from 6.2.0 to 6.2.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.

• The recommended version was released 2 years ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	646	Proof of Concept

Release notes

Package name: tar

• 6.2.1 - 2024-03-21
  

  v6.2.1

• 6.2.0 - 2023-09-05
  

  6.2.0

from tar GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[greptile-apps]

Greptile Overview

Summary

This PR upgrades the tar dependency from 6.2.0 to 6.2.1, which patches a medium-severity resource exhaustion vulnerability (SNYK-JS-TAR-6476909, score 646).

• Fixes uncontrolled resource consumption issue in tar package
• Patch version bump with no breaking changes
• Standard lockfile update with new package integrity hash and license metadata

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• This is a straightforward security patch that upgrades tar from 6.2.0 to 6.2.1, fixing a resource exhaustion vulnerability. It's a patch version bump with no breaking changes, only dependency manifest updates, and addresses a known security issue.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
npm/package.json	5/5	Updated tar dependency from 6.2.0 to 6.2.1 to fix resource exhaustion vulnerability
npm/package-lock.json	5/5	Lockfile updated with tar 6.2.1 resolved package and ISC license metadata

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant Snyk as Snyk Security
    participant NPM as NPM Registry
    participant Pkg as package.json
    participant Lock as package-lock.json

    Snyk->>Dev: Alert: tar 6.2.0 has vulnerability
    Dev->>Pkg: Update tar: ^6.2.0 → ^6.2.1
    Dev->>NPM: Fetch [email protected] metadata
    NPM-->>Lock: Return resolved package info
    Lock->>Lock: Update tar version & integrity hash
    Lock->>Lock: Add ISC license metadata
    Dev->>Dev: Commit changes
    Note over Pkg,Lock: Resource exhaustion vulnerability patched

Loading

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}