fix: revert blanket tar 7.5.21 bump, exclude GHSA-r292-9mhp-454m instead - #9553
Merged
Merged
Conversation
The blanket root resolution forced tar 7.5.21 onto every consumer,
including lerna's own exact pin of tar@6.2.1. lerna's bundled dist
code interops with tar via CJS require() expecting the 6.x export
shape (plain module.exports = { create, extract, ... }); tar 7.x's
different export shape leaves import_tar.default.create undefined,
breaking `lerna publish` at packDirectory.
Revert tar to 6.2.1 (restoring the swarm-js/tar resolution too) and
exclude the new advisory in osv-scanner.toml with the same
packing-only/lerna-packDirectory reasoning already used for the
other tar CVEs in this file.
TICKET: CECHO-2021
Contributor
manojkumar138
approved these changes
Aug 25, 2026
diksha190
approved these changes
Aug 25, 2026
diksha190
left a comment
diksha190
left a comment
There was a problem hiding this comment.
Approved.
Root cause checks out : tar@7.5.21's ESM/CJS export shape mismatch breaks lerna's CJS require("tar") interop in packDirectory, matching the same "lerna needs tar v6" constraint already established elsewhere in osv-scanner.toml.
Standalone repro of lerna's exact packDirectory call against tar@6.2.1 confirms it works.
gokulhost
approved these changes
Aug 25, 2026
lokesh-bitgo
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packDirectorywithTypeError: Cannot read properties of undefined (reading 'create'), caused by 98b76a5's blanket rootresolutions.tar: "7.5.21", which also overrode lerna's own exacttar@6.2.1pin.dist/index.jsinterops with tar via CJSrequire("tar")expecting the 6.x export shape (module.exports = { create, extract, ... }); tar 7.x's different export shape leavesimport_tar.default.createundefined at runtime.osv-scanner.toml("lerna requires tar v6 ... forcing v7.x breaks lerna's packDirectory API ... our usage is archive PACKING only"), which 98b76a5 didn't follow for the new GHSA-r292-9mhp-454m advisory.tarback to6.2.1(restoring the**/swarm-js/**/tarresolution too) and adds a new[[IgnoredVulns]]entry for GHSA-r292-9mhp-454m with the same reasoning as the other tar exclusions.Fixes CECHO-2021.
Test plan
yarn installsucceeds;node_modules/tarresolves back to6.2.1packDirectorycall (tar.create({ cwd, prefix: 'package/', portable: true, mtime, gzip: true }, files)) directly against the installed tar — succeeds and produces a valid.tgzosv-scanner.tomlis valid TOML with the newGHSA-r292-9mhp-454mentrypackDirectory