[Snyk] Upgrade tar from 6.1.0 to 6.1.13 #1

snyk-bot · 2023-01-19T01:00:09Z

Snyk has created this PR to upgrade tar from 6.1.0 to 6.1.13.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 13 versions ahead of your current version.
The recommended version was released a month ago, on 2022-12-07.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Arbitrary File Write SNYK-JS-TAR-1579155	639/1000 Why? Has a fix available, CVSS 8.5	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	639/1000 Why? Has a fix available, CVSS 8.5	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	639/1000 Why? Has a fix available, CVSS 8.5	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	639/1000 Why? Has a fix available, CVSS 8.5	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	639/1000 Why? Has a fix available, CVSS 8.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	639/1000 Why? Has a fix available, CVSS 8.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: tar

6.1.13 - 2022-12-07
6.1.13 (2022-12-07)

Dependencies
- cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0
6.1.12 - 2022-11-01
6.1.12 (2022-10-31)

Bug Fixes
- 57493ee #332 ensuring close event is emited after stream has ended (@ webark)
- b003c64 #314 replace deprecated String.prototype.substr() (#314) (@ CommanderRoot, @ lukekarrys)
Documentation
- f129929 #313 remove dead link to benchmarks (#313) (@ yetzt)
- c1faa9f add examples/explanation of using tar.t (@ isaacs)
6.1.11 - 2021-08-26
6.1.11
6.1.10 - 2021-08-19
6.1.10
6.1.9 - 2021-08-19
6.1.9
6.1.8 - 2021-08-11
6.1.8
6.1.7 - 2021-08-09
6.1.6 - 2021-08-04
6.1.5 - 2021-08-04
6.1.4 - 2021-08-03
6.1.3 - 2021-08-02
6.1.2 - 2021-07-26
6.1.1 - 2021-07-23
6.1.0 - 2021-01-07

from tar GitHub release notes

Commit messages

Package name: tar

a044a87 chore: release 6.1.13 (Is "Pre-built binaries not found for ...." really an error? mapbox/node-pre-gyp#344)
cc4e0dd deps: bump minipass from 3.3.6 to 4.0.0
5dcfcb3 chore: bump events-to-array from 1.1.2 to 2.0.3
329caed chore: postinstall for dependabot template-oss PR
72f6e39 chore: bump @ npmcli/template-oss from 4.8.0 to 4.10.0
001eafb chore: release 6.1.12
ac1026a chore: dry up template-oss config
2e45b11 chore: use a local instead of remote file for test
79378ef chore: postinstall for dependabot template-oss PR
eaea26d chore: bump @ npmcli/template-oss from 4.7.1 to 4.8.0
57493ee fix: ensuring close event is emited after stream has ended
1e3fadf chore: postinstall for dependabot template-oss PR
24045dc chore: bump @ npmcli/template-oss from 4.6.2 to 4.7.1
b003c64 fix: replace deprecated String.prototype.substr() (Use tap mapbox/node-pre-gyp#314)
d9edb34 chore: postinstall for dependabot template-oss PR
c78c108 chore: bump @ npmcli/template-oss from 4.6.1 to 4.6.2
2a49e7a chore: postinstall for dependabot template-oss PR
39c60ad chore: bump @ npmcli/template-oss from 4.5.1 to 4.6.1
08cc156 chore: bump @ npmcli/eslint-config from 3.1.0 to 4.0.0
fc207a8 chore: postinstall for dependabot template-oss PR
14e43f7 chore: bump @ npmcli/template-oss from 4.4.4 to 4.5.1
9d71c56 chore: postinstall for dependabot template-oss PR
118a6c8 chore: bump @ npmcli/template-oss from 4.3.2 to 4.4.4
cfddd42 chore: bump rimraf from 2.7.1 to 3.0.2