From 3143985423cad59ae68cc98a747deaaeba2a47a8 Mon Sep 17 00:00:00 2001 From: "scale-prodsec[bot]" <262621375+scale-prodsec[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 22:23:24 +0000 Subject: [PATCH] fix(agentex-ui): bump tar 7.5.20 -> 7.5.22 (GHSA-r292-9mhp-454m) Raises the tar override floor to ^7.5.21 and re-locks agentex-ui/package-lock.json, resolving tar to 7.5.22 (>= fixed 7.5.21). Fixes GHSA-r292-9mhp-454m (node-tar uncontrolled recursion / uncatchable stack-overflow DoS). tar is a transitive dependency of @tailwindcss/oxide@4.1.11 (requires tar ^7.4.3), which supports the 7.5.x line; this is a same-minor patch bump with no dependency contract change. Resolves GFDVR-20835. Co-Authored-By: Claude Opus 4.8 (1M context) --- agentex-ui/package-lock.json | 6 +++--- agentex-ui/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/agentex-ui/package-lock.json b/agentex-ui/package-lock.json index 89cbe3a9..a613d1ca 100644 --- a/agentex-ui/package-lock.json +++ b/agentex-ui/package-lock.json @@ -10897,9 +10897,9 @@ } }, "node_modules/tar": { - "version": "7.5.20", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz", - "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", diff --git a/agentex-ui/package.json b/agentex-ui/package.json index b3089aec..b93a613f 100644 --- a/agentex-ui/package.json +++ b/agentex-ui/package.json @@ -58,7 +58,7 @@ "cross-spawn": "^7.0.5", "postcss": "^8.5.10", "sharp": "^0.35.0", - "tar": "^7.5.16" + "tar": "^7.5.21" }, "devDependencies": { "@eslint/eslintrc": "^3.3.1",