[Snyk] Upgrade tar from 6.1.9 to 6.2.1

[leshk0de]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade tar from 6.1.9 to 6.2.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 8 versions ahead of your current version.
• The recommended version was released 24 days ago, on 2024-03-21.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Poisoning SNYK-JS-QS-3153490	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: tar

• 6.2.1 - 2024-03-21
  

  v6.2.1

• 6.2.0 - 2023-09-05
  

  6.2.0

• 6.1.15 - 2023-05-17
  

  6.1.15

• 6.1.14 - 2023-05-02
  

  6.1.14

• 6.1.13 - 2022-12-07
  

  6.1.13 (2022-12-07)

  Dependencies

  • cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0
• 6.1.12 - 2022-11-01
  

  6.1.12 (2022-10-31)

  Bug Fixes

  • 57493ee #332 ensuring close event is emited after stream has ended (@ webark)
  • b003c64 #314 replace deprecated String.prototype.substr() (#314) (@ CommanderRoot, @ lukekarrys)

  Documentation

  • f129929 #313 remove dead link to benchmarks (#313) (@ yetzt)
  • c1faa9f add examples/explanation of using tar.t (@ isaacs)
• 6.1.11 - 2021-08-26
  

  6.1.11

• 6.1.10 - 2021-08-19
  

  6.1.10

• 6.1.9 - 2021-08-19
  

  6.1.9

from tar GitHub release notes

Commit messages

Package name: tar

• c65f76d 6.2.1
• ffe6824 prevent extraction in excessively deep subfolders
• fe7ebfd remove security.md
• 5bc9d40 6.2.0
• fe1ef5e changelog 6.2
• e483220 get rid of npm lint stuff
• 689928a ci that works outside of npm org
• db6f539 file inference improvements for .tbr and .tgz
• 336fa8f refactor: dry and other pr comments
• eeba222 chore: lint fixes
• c9fc57c feat: add initial support for brotli
• 8c5af15 silence dependabot
• 3302cf7 6.1.15
• 4501bdb Normalize unicode internally using NFD
• 24efc74 remove parallelism causing test/pack.js to be flaky
• 8cd8139 move mutateFS reset out of t.teardown
• 4aaffc8 6.1.14
• 4cbdd67 deps: [email protected]
• 75d3081 fix: update repository url in package.json
• 82bb328 chore: postinstall for dependabot template-oss PR
• 5f31636 chore: bump @ npmcli/template-oss from 4.10.0 to 4.11.0
• a044a87 chore: release 6.1.13 (Re #340 - snapshot should not be modified by ignore text dgtlmoon/changedetection.io#344)
• cc4e0dd deps: bump minipass from 3.3.6 to 4.0.0
• 5dcfcb3 chore: bump events-to-array from 1.1.2 to 2.0.3

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs