[Snyk] Upgrade tar from 6.1.0 to 6.2.0

[silkchamberlin]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade tar from 6.1.0 to 6.2.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 16 versions ahead of your current version.
• The recommended version was released 5 months ago, on 2023-09-05.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Arbitrary File Overwrite SNYK-JS-TAR-1536528	624/1000 Why? Has a fix available, CVSS 8.2	No Known Exploit
	Arbitrary File Overwrite SNYK-JS-TAR-1536531	624/1000 Why? Has a fix available, CVSS 8.2	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579147	624/1000 Why? Has a fix available, CVSS 8.2	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579152	624/1000 Why? Has a fix available, CVSS 8.2	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579155	624/1000 Why? Has a fix available, CVSS 8.2	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	624/1000 Why? Has a fix available, CVSS 8.2	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: tar

• 6.2.0 - 2023-09-05
  

  6.2.0

• 6.1.15 - 2023-05-17
  

  6.1.15

• 6.1.14 - 2023-05-02
  

  6.1.14

• 6.1.13 - 2022-12-07
  

  6.1.13 (2022-12-07)

  Dependencies

  • cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0
• 6.1.12 - 2022-11-01
  

  6.1.12 (2022-10-31)

  Bug Fixes

  • 57493ee #332 ensuring close event is emited after stream has ended (@ webark)
  • b003c64 #314 replace deprecated String.prototype.substr() (#314) (@ CommanderRoot, @ lukekarrys)

  Documentation

  • f129929 #313 remove dead link to benchmarks (#313) (@ yetzt)
  • c1faa9f add examples/explanation of using tar.t (@ isaacs)
• 6.1.11 - 2021-08-26
  

  6.1.11

• 6.1.10 - 2021-08-19
  

  6.1.10

• 6.1.9 - 2021-08-19
  

  6.1.9

• 6.1.8 - 2021-08-11
• 6.1.7 - 2021-08-09
• 6.1.6 - 2021-08-04
• 6.1.5 - 2021-08-04
• 6.1.4 - 2021-08-03
• 6.1.3 - 2021-08-02
• 6.1.2 - 2021-07-26
• 6.1.1 - 2021-07-23
• 6.1.0 - 2021-01-07

from tar GitHub release notes

Commit messages

Package name: tar

• 5bc9d40 6.2.0
• fe1ef5e changelog 6.2
• e483220 get rid of npm lint stuff
• 689928a ci that works outside of npm org
• db6f539 file inference improvements for .tbr and .tgz
• 336fa8f refactor: dry and other pr comments
• eeba222 chore: lint fixes
• c9fc57c feat: add initial support for brotli
• 8c5af15 silence dependabot
• 3302cf7 6.1.15
• 4501bdb Normalize unicode internally using NFD
• 24efc74 remove parallelism causing test/pack.js to be flaky
• 8cd8139 move mutateFS reset out of t.teardown
• 4aaffc8 6.1.14
• 4cbdd67 deps: minipass@5.0.0
• 75d3081 fix: update repository url in package.json
• 82bb328 chore: postinstall for dependabot template-oss PR
• 5f31636 chore: bump @ npmcli/template-oss from 4.10.0 to 4.11.0
• a044a87 chore: release 6.1.13 (Add "help" command LightTable/LightTable#344)
• cc4e0dd deps: bump minipass from 3.3.6 to 4.0.0
• 5dcfcb3 chore: bump events-to-array from 1.1.2 to 2.0.3
• 329caed chore: postinstall for dependabot template-oss PR
• 72f6e39 chore: bump @ npmcli/template-oss from 4.8.0 to 4.10.0
• 001eafb chore: release 6.1.12

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs