You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
tar was never used by this project — no source file imports it, and nothing in the dependency tree requires it.
It was introduced as a bare root pin (tar: ">=4.4.18", later >=6.2.1) in TCE-797 (#93) to force an upgrade of the tar that fsevents@1.xbundles for node-pre-gyp. A root-level dependency cannot override a nested bundled one, so the pin never fixed the vulnerable copy — it just added a second, independent tar to the tree. That second copy is what has now been flagged twice (it was already bumped once in #95).
Since nothing else requires it, deleting the pin removes tar and its six exclusive deps (fs-minipass, minipass, minizlib, chownr, mkdirp, yallist) from the lockfile entirely.
Notes for review
Advisory ranges from npm are wider than the scanner's for two of these (tar <=7.5.20 vs <=7.5.18; form-data 3.0.0-3.0.4 vs <3.0.4). The higher fixed versions were used, otherwise npm audit would still report them.
lockfileVersion is deliberately kept at 2. CI runs Node 10 (npm 6), which cannot read lockfileVersion 3.
The full lockfile diff is 47 entry changes: the 4 targets, 10 collateral patch bumps within existing ranges, 21 new transitive deps of the updated crypto shims, and 13 removals (tar + its deps, plus has-proto which the newer get-intrinsic no longer needs).
Verification
npm ci → exit 0, 990 packages
all five packages report clear in npm audit
npm run build produces a byte-identical bundle — hash 61cff45dbf8e65fc, matching a pre-change baseline build. No build output is included in this PR.
Pre-existing issues, not addressed here
The build fails on modern Node. Webpack 4 hits error:0308010C:digital envelope routines::unsupported under OpenSSL 3; this reproduces on master. Building today requires NODE_OPTIONS=--openssl-legacy-provider (or Node <= 16), which is how the baseline above was produced.
The committed material/ assets no longer match what the toolchain produces — rebuilding yields different content hashes than the checked-in files. Unchanged by this PR, but worth noting since the build workflow's last step is a git diff drift check.
Four are dev-only transitive deps, updated within their existing parent
semver ranges (lockfile-only, no package.json change):
- form-data 3.0.0 -> 3.0.5 CVE-2025-7783 (via gitlab, ^3.0.0)
- cipher-base 1.0.4 -> 1.0.7 CVE-2025-9287 (via browserify-aes/des, create-hash/hmac)
- sha.js 2.4.11 -> 2.4.12 CVE-2025-9288 (via create-hash/hmac, pbkdf2)
- pbkdf2 3.1.2 -> 3.1.6 CVE-2025-6547 (via crypto-browserify, parse-asn1)
tar (CVE-2026-59873) is removed rather than bumped. It was never used by
this project - no source file imports it. It was added as a bare root pin
in TCE-797 to force an upgrade of the tar that fsevents@1.x bundled for
node-pre-gyp, but a root-level dependency cannot override a nested bundled
one, so the pin fixed nothing and simply added a second copy of tar to the
tree. That copy is what Vanta has now flagged twice (also bumped in #95).
Nothing else in the tree requires tar, so removing the pin drops it
entirely.
Note the advisory ranges npm reports are wider than Vanta's for two of
these (tar <=7.5.20 vs <=7.5.18, form-data 3.0.0-3.0.4 vs <3.0.4), so the
higher fixed versions were used.
lockfileVersion deliberately kept at 2: CI runs Node 10 (npm 6), which
cannot read lockfileVersion 3.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR addresses five critical vulnerabilities (form-data, cipher-base, sha.js, pbkdf2, and tar) and maintains lockfile compatibility for Node 10. While the updates are largely beneficial and Codacy results are up to standards, the removal of the 'tar' dependency requires careful verification. If 'tar' is used directly in the codebase or was previously pinned to mitigate transitive vulnerabilities (such as CVE-2023-46136), its removal may lead to runtime failures or security regressions. The provided test plan focuses on auditing the final dependency tree and verifying build integrity to ensure no regressions were introduced.
Test suggestions
Verify that npm audit reports no vulnerabilities for the targeted packages after the update.\n- [ ] Verify 'tar' and its exclusive transitive dependencies (fs-minipass, minipass, minizlib, chownr, mkdirp, yallist) are purged from the lockfile.\n- [ ] Run the build pipeline and compare the bundle hash to ensure no functional regressions occurred during dependency updates.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that npm audit reports no vulnerabilities for the targeted packages after the update.\n- [ ] Verify 'tar' and its exclusive transitive dependencies (fs-minipass, minipass, minizlib, chownr, mkdirp, yallist) are purged from the lockfile.\n- [ ] Run the build pipeline and compare the bundle hash to ensure no functional regressions occurred during dependency updates.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
The PR title mentions resolving a vulnerability in 'tar', but the package was removed from 'package.json'. If this entry was used to override a transitive vulnerability (e.g., for node-gyp), removing it may re-introduce the risk. Additionally, if 'tar' is used directly in the code, this change will cause a runtime error. \n\nCheck if 'tar' is used directly or as a version override; if it is still required by the dependency tree, ensure it is updated to a secure version rather than being removed.
The build job has been failing at 'Set up job' for every non-master branch
since GitHub closed down actions/cache v1:
This request has been automatically failed because it uses a deprecated
version of actions/cache: v1
Nothing in the job ever ran, so every PR has been red for months. It went
unnoticed because the job is skipped on master (if: github.ref != master),
and a skipped job reports success.
actions/checkout v2 -> v4
actions/setup-node v1 -> v4
actions/cache v1 -> v4
NODE_VERSION is left at 10.x deliberately: the committed material/ assets
were built with it, and Node 10 (OpenSSL 1.1) still provides the md4 hash
webpack 4 needs. Every dependency changed in this PR is Node 10 compatible
(strictest engine is form-data >= 6).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Resolves 5 critical dependency advisories flagged by our dependency scanner.
Four in-range updates (lockfile only)
All four are dev-only transitive dependencies whose fixed versions already satisfy their parents' semver ranges, so no
package.jsonchange was needed:form-datagitlab(^3.0.0)cipher-basebrowserify-aes/-des,create-hash/-hmacsha.jscreate-hash/-hmac,pbkdf2pbkdf2crypto-browserify,parse-asn1taris removed, not bumped (CVE-2026-59873)tarwas never used by this project — no source file imports it, and nothing in the dependency tree requires it.It was introduced as a bare root pin (
tar: ">=4.4.18", later>=6.2.1) in TCE-797 (#93) to force an upgrade of thetarthatfsevents@1.xbundles fornode-pre-gyp. A root-level dependency cannot override a nested bundled one, so the pin never fixed the vulnerable copy — it just added a second, independenttarto the tree. That second copy is what has now been flagged twice (it was already bumped once in #95).Since nothing else requires it, deleting the pin removes
tarand its six exclusive deps (fs-minipass,minipass,minizlib,chownr,mkdirp,yallist) from the lockfile entirely.Notes for review
tar <=7.5.20vs<=7.5.18;form-data 3.0.0-3.0.4vs<3.0.4). The higher fixed versions were used, otherwisenpm auditwould still report them.lockfileVersionis deliberately kept at 2. CI runs Node 10 (npm 6), which cannot readlockfileVersion3.tar+ its deps, plushas-protowhich the newerget-intrinsicno longer needs).Verification
npm ci→ exit 0, 990 packagesnpm auditnpm run buildproduces a byte-identical bundle — hash61cff45dbf8e65fc, matching a pre-change baseline build. No build output is included in this PR.Pre-existing issues, not addressed here
error:0308010C:digital envelope routines::unsupportedunder OpenSSL 3; this reproduces onmaster. Building today requiresNODE_OPTIONS=--openssl-legacy-provider(or Node <= 16), which is how the baseline above was produced.material/assets no longer match what the toolchain produces — rebuilding yields different content hashes than the checked-in files. Unchanged by this PR, but worth noting since the build workflow's last step is agit diffdrift check.🤖 Generated with Claude Code