fix: upgrade tar to 7.5.19 (CVE-2026-59873)#6068
Conversation
Automated dependency upgrade by OrbisAI Security
|
The security intent is clear from the summary and verification section. Could you add the |
lefarcen
added
size/XS
|
Surface area: None. This only bumps tar 7.5.15 → 7.5.19 to fix CVE-2026-59873 (a DoS via unbounded gzip decompression). No application code changes, no config changes, no new files touched besides the manifest/lockfile. tar's own release notes show this as a bugfix/hardening release (adds limits on decompressed size/entry count), not a breaking API change, so no behaviour change is expected on the happy path. |
|
Thanks — that clarifies the scope. Could you copy two bits into the PR description itself so pool review has everything in one place: |
tar is not a direct open-design import; using pnpm.overrides keeps the 7.5.19 version forced across the transitive tree without adding an unused top-level dependency to the manifest.
|
Addressed the dependency-promotion issue: tar isn't imported directly by open-design, so adding it to dependencies was the wrong fix vector. Switched to pnpm.overrides (matching the existing pattern for brace-expansion, postcss, qs, etc.), which forces the resolved version across the transitive tree without introducing an unused direct dependency into the manifest. Ran pnpm install to regenerate the lockfile; tar@7.5.19 is still resolved everywhere. |
2 participants
Summary
Upgrade tar from 7.5.15 to 7.5.19 to fix CVE-2026-59873.
Vulnerability
CVE-2026-59873pnpm-lock.yamlDescription: tar: node-tar: Denial of Service via crafted gzip bomb
Evidence
Scanner confirmation: trivy rule
CVE-2026-59873flagged this pattern.Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a Node.js library - vulnerabilities affect downstream consumers who use this package.
Surface area: None
Changes
package.jsonpnpm-lock.yamlBehavior Preservation
The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.
Verification
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security