Summary
package-lock.json currently resolves tar@6.2.1 via:
@mapbox/node-pre-gyp@1.0.11 -> tar@^6.1.11node-gyp@10.3.1 -> tar@^6.2.1
This leaves the repo with open tar advisories such as hardlink/symlink escape issues (e.g. GHSA-83g3-92jg-28cx).
Why this matters
Dependabot cannot auto-resolve these advisories in the current dependency graph, because both paths are constrained to tar@6.x.
Proposed direction
- Update
@mapbox/node-pre-gyp to ^2.0.3 (uses tar@^7.4.0)
- Update
node-gyp to ^11.5.0 (uses tar@^7.4.3)
I prepared a PR for this update.
Compatibility note
This likely raises effective install-time Node requirements (because @mapbox/node-pre-gyp@2.x requires Node >=18).
If maintaining Node 10/12/14/16 compatibility is still required, please advise on preferred strategy (major release, conditional path, or alternative tooling).
Summary
package-lock.jsoncurrently resolvestar@6.2.1via:@mapbox/node-pre-gyp@1.0.11 -> tar@^6.1.11node-gyp@10.3.1 -> tar@^6.2.1This leaves the repo with open
taradvisories such as hardlink/symlink escape issues (e.g. GHSA-83g3-92jg-28cx).Why this matters
Dependabot cannot auto-resolve these advisories in the current dependency graph, because both paths are constrained to
tar@6.x.Proposed direction
@mapbox/node-pre-gypto^2.0.3(usestar@^7.4.0)node-gypto^11.5.0(usestar@^7.4.3)I prepared a PR for this update.
Compatibility note
This likely raises effective install-time Node requirements (because
@mapbox/node-pre-gyp@2.xrequires Node>=18).If maintaining Node 10/12/14/16 compatibility is still required, please advise on preferred strategy (major release, conditional path, or alternative tooling).