build(deps): bump tar and semantic-release#373
Conversation
# [5.24.0](v5.23.0...v5.24.0) (2026-07-13) ### Bug Fixes * remove unnecessary rectangle from tail-TN.svg AB[#1587656](https://github.com/AlaskaAirlines/Icons/issues/1587656) ([bf8490e](bf8490e)) ### Features * **hazmat:** add filled and outline icons for portable power banks AB[#1596233](https://github.com/AlaskaAirlines/Icons/issues/1596233) ([37a1d7c](37a1d7c)) * **tail:** add Jetstar Japan, Jetstar Australia, Breeze tail icons AB[#1552872](https://github.com/AlaskaAirlines/Icons/issues/1552872) ([d8aa492](d8aa492))
Bumps [tar](https://github.com/isaacs/node-tar) to 7.5.19 and updates ancestor dependency [semantic-release](https://github.com/semantic-release/semantic-release). These dependencies need to be updated together. Updates `tar` from 6.2.1 to 7.5.19 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.1...v7.5.19) Updates `semantic-release` from 24.0.0 to 25.0.7 - [Release notes](https://github.com/semantic-release/semantic-release/releases) - [Commits](semantic-release/semantic-release@v24.0.0...v25.0.7) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.19 dependency-type: indirect - dependency-name: semantic-release dependency-version: 25.0.7 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 7 security issues
Security issues:
- BlueOak-1.0.0: Open-source license could not be identified (link)
- BlueOak-1.0.0: Open-source license could not be identified (link)
- BlueOak-1.0.0: Open-source license could not be identified (link)
- BlueOak-1.0.0: Open-source license could not be identified (link)
- BlueOak-1.0.0: Open-source license could not be identified (link)
- BlueOak-1.0.0: Open-source license could not be identified (link)
- BlueOak-1.0.0: Open-source license could not be identified (link)
Fixed security issues:
- package-lock.json (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="package-lock.json" line_range="8908-8916" />
<code_context>
</code_context>
<issue_to_address>
**security (license/chownr):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>
### Comment 2
<location path="package-lock.json" line_range="8950-8958" />
<code_context>
</code_context>
<issue_to_address>
**security (license/common-ancestor-path):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>
### Comment 3
<location path="package-lock.json" line_range="9176-9184" />
<code_context>
</code_context>
<issue_to_address>
**security (license/isexe):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>
### Comment 4
<location path="package-lock.json" line_range="9426-9433" />
<code_context>
</code_context>
<issue_to_address>
**security (license/minipass):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>
### Comment 5
<location path="package-lock.json" line_range="9464-9475" />
<code_context>
</code_context>
<issue_to_address>
**security (license/minipass-flush):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>
### Comment 6
<location path="package-lock.json" line_range="10014-10029" />
<code_context>
</code_context>
<issue_to_address>
**security (license/tar):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>
### Comment 7
<location path="package-lock.json" line_range="10170-10178" />
<code_context>
</code_context>
<issue_to_address>
**security (license/yallist):** BlueOak-1.0.0: Open-source license could not be identified
The obligations of the `BlueOak-1.0.0` license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
*Source: trivy*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| "node_modules/npm/node_modules/chownr": { | ||
| "version": "2.0.0", | ||
| "version": "3.0.0", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC", | ||
| "license": "BlueOak-1.0.0", | ||
| "engines": { | ||
| "node": ">=10" | ||
| "node": ">=18" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/chownr): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
| "node_modules/npm/node_modules/common-ancestor-path": { | ||
| "version": "1.0.1", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC" | ||
| }, | ||
| "node_modules/npm/node_modules/cross-spawn": { | ||
| "version": "7.0.3", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "MIT", | ||
| "dependencies": { | ||
| "path-key": "^3.1.0", | ||
| "shebang-command": "^2.0.0", | ||
| "which": "^2.0.1" | ||
| }, | ||
| "engines": { | ||
| "node": ">= 8" | ||
| } | ||
| }, | ||
| "node_modules/npm/node_modules/cross-spawn/node_modules/which": { | ||
| "version": "2.0.2", | ||
| "version": "2.0.0", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "isexe": "^2.0.0" | ||
| }, | ||
| "bin": { | ||
| "node-which": "bin/node-which" | ||
| }, | ||
| "license": "BlueOak-1.0.0", | ||
| "engines": { | ||
| "node": ">= 8" | ||
| "node": ">= 18" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/common-ancestor-path): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
| "node_modules/npm/node_modules/isexe": { | ||
| "version": "2.0.0", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC" | ||
| }, | ||
| "node_modules/npm/node_modules/jackspeak": { | ||
| "version": "3.4.0", | ||
| "version": "4.0.0", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "BlueOak-1.0.0", | ||
| "dependencies": { | ||
| "@isaacs/cliui": "^8.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": ">=14" | ||
| }, | ||
| "funding": { | ||
| "url": "https://github.com/sponsors/isaacs" | ||
| }, | ||
| "optionalDependencies": { | ||
| "@pkgjs/parseargs": "^0.11.0" | ||
| "node": ">=20" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/isexe): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
| "node_modules/npm/node_modules/minipass": { | ||
| "version": "7.1.2", | ||
| "version": "7.1.3", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC", | ||
| "license": "BlueOak-1.0.0", | ||
| "engines": { | ||
| "node": ">=16 || 14 >=14.17" | ||
| } |
There was a problem hiding this comment.
security (license/minipass): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
| "node_modules/npm/node_modules/minipass-flush": { | ||
| "version": "1.0.5", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC", | ||
| "dependencies": { | ||
| "minipass": "^3.0.0" | ||
| }, | ||
| "engines": { | ||
| "node": ">= 8" | ||
| } | ||
| }, | ||
| "node_modules/npm/node_modules/minipass-flush/node_modules/minipass": { | ||
| "version": "3.3.6", | ||
| "version": "1.0.6", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC", | ||
| "license": "BlueOak-1.0.0", | ||
| "dependencies": { | ||
| "yallist": "^4.0.0" | ||
| "minipass": "^7.1.3" | ||
| }, | ||
| "engines": { | ||
| "node": ">=8" | ||
| "node": ">=16 || 14 >=14.17" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/minipass-flush): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
| "node_modules/npm/node_modules/tar": { | ||
| "version": "7.5.19", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC", | ||
| "license": "BlueOak-1.0.0", | ||
| "dependencies": { | ||
| "@isaacs/fs-minipass": "^4.0.0", | ||
| "chownr": "^3.0.0", | ||
| "minipass": "^7.1.2", | ||
| "minizlib": "^3.1.0", | ||
| "yallist": "^5.0.0" | ||
| }, | ||
| "engines": { | ||
| "node": "^14.17.0 || ^16.13.0 || >=18.0.0" | ||
| "node": ">=18" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/tar): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
| "node_modules/npm/node_modules/yallist": { | ||
| "version": "4.0.0", | ||
| "version": "5.0.0", | ||
| "dev": true, | ||
| "inBundle": true, | ||
| "license": "ISC" | ||
| "license": "BlueOak-1.0.0", | ||
| "engines": { | ||
| "node": ">=18" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/yallist): BlueOak-1.0.0: Open-source license could not be identified
The obligations of the BlueOak-1.0.0 license for this code could not be determined automatically. Unknown licenses may carry obligations or restrictions and should be reviewed manually to ensure compliance
Source: trivy
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
4 participants
Bumps tar to 7.5.19 and updates ancestor dependency semantic-release. These dependencies need to be updated together.
Updates
tarfrom 6.2.1 to 7.5.19Changelog
Sourced from tar's changelog.
... (truncated)
Commits
be440da7.5.192812e93add maxDecompressionRatio guard against explosive decompression9ecd4d27.5.189e78bf0refuse to let header size be less than 0e02a4e9pax: parse values according to known types9cbdb317.5.177a635c2terminate pax strings on nul bytescf213387.5.1621a8220do not apply PAX header fields to meta entries52632cfupdate project depsMaintainer changes
This version was pushed to npm by isaacs, a new releaser for tar since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
semantic-releasefrom 24.0.0 to 25.0.7Release notes
Sourced from semantic-release's releases.
... (truncated)
Commits
c46dbdafix: argument Injection via repositoryUrl in package.json (#4245)7abb562chore(deps): update npm to v12 (#4244)8b15865chore(deps): update dependency@types/nodeto v24.13.3 (#4243)8e28dd3fix: ensure encoded secrets get maskedf293647Merge commit from forka973d20ci(action): update github/codeql-action action to v4.37.0 (#4241)c62136fchore(deps): update dependency mockserver-client to v7.4.0 (#4240)9be3e6cchore(deps): lock file maintenance (#4239)3259ebbchore(deps): update dependency got to v15.1.0 (#4238)1c17eb5chore(deps): update dependency mockserver-client to v7.3.0 (#4237)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for semantic-release since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.