fix(agentex-ui): bump tar 7.5.20 -> 7.5.22 (GHSA-r292-9mhp-454m)

[scale-prodsec]

Summary

Remediates GHSA-r292-9mhp-454m (MEDIUM) in tar for the agentex-ui service.

• Package: tar (node-pkg)
• Before: 7.5.20 (vulnerable)
• After: 7.5.22 (>= fixed version 7.5.21)
• Advisory: node-tar uncontrolled recursion in mapHas/filesFilter allows an uncatchable stack-overflow DoS via a crafted long-path tar with member selection.

Change

tar is a transitive dependency (pulled in by @tailwindcss/oxide@4.1.11, which requires tar ^7.4.3) and is force-pinned via the root overrides block. This PR:

1. Raises the overrides.tar floor from ^7.5.16 to ^7.5.21 in agentex-ui/package.json so a future re-lock can never float back below the fix.
2. Re-locks agentex-ui/package-lock.json (lockfile-only), resolving tar to 7.5.22 (latest patch satisfying the new floor).

This is a same-minor (7.5.x) patch bump with no dependency-contract change; @tailwindcss/oxide@4.1.11 supports the 7.5.x line, so the transitive pin is safe.

Verification

• npm ci --dry-run succeeds — lockfile is in sync with package.json (CI npm ci gate passes).
• Version gate: tar 7.5.21 and 7.5.22 both have zero known advisories (OSV).
• Diff scope: only overrides.tar and the single node_modules/tar lockfile entry changed; no transitive-closure churn, no registry flips (public npm preserved), no app-code changes.
• Old tar-7.5.20.tgz is fully removed from the lockfile.

CVEs closed

• GHSA-r292-9mhp-454m

Resolves GFDVR-20835.

🤖 Generated with Claude Code

Greptile Summary

This PR remediates GHSA-r292-9mhp-454m by patching the transitive tar dependency from 7.5.20 to 7.5.22 in the agentex-ui service. The fix uses the existing overrides block to pin tar and raises the floor so future re-locks cannot float back to a vulnerable version.

• package.json: overrides.tar floor raised from ^7.5.16 to ^7.5.21, ensuring the constraint permanently excludes the vulnerable 7.5.16–7.5.20 range.
• package-lock.json: Lockfile-only update resolving tar to 7.5.22 with an updated integrity hash; no other dependencies were changed.

Confidence Score: 5/5

Minimal, targeted lockfile-only change with no app code touched — safe to merge.

The diff is entirely confined to raising a semver floor in overrides and re-locking a single transitive dependency to a newer patch. The 7.5.x line is fully compatible with @tailwindcss/oxide@4.1.11, and the change introduces no new dependencies or logic.

Files Needing Attention: No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Raises the overrides.tar floor from ^7.5.16 to ^7.5.21 to prevent the lockfile from resolving back to a vulnerable version on future re-locks.
agentex-ui/package-lock.json	Lockfile-only update: resolves tar from 7.5.20 to 7.5.22 with updated integrity hash; no transitive-closure churn or other dependency changes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["@tailwindcss/oxide@4.1.11"] -->|"requires tar ^7.4.3"| B["tar (transitive)"]
    C["agentex-ui/package.json\noverrides.tar"] -->|"force-pin floor"| B
    B -->|"Before: 7.5.20\n(GHSA-r292-9mhp-454m)"| D["❌ Vulnerable"]
    B -->|"After: 7.5.22\n(patched)"| E["✅ Fixed"]
    C -->|"floor: ^7.5.16 → ^7.5.21"| F["Future re-locks cannot\nresolve < 7.5.21"]

Loading

_{Reviews (1): Last reviewed commit: "fix(agentex-ui): bump tar 7.5.20 -> 7.5...." | Re-trigger Greptile}