Skip to content

Override tar to ^7.5.11 across all workspaces#26731

Merged
frankmueller-msft merged 5 commits intomainfrom
fix/tar-security-override
Mar 16, 2026
Merged

Override tar to ^7.5.11 across all workspaces#26731
frankmueller-msft merged 5 commits intomainfrom
fix/tar-security-override

Conversation

@frankmueller-msft
Copy link
Contributor

@frankmueller-msft frankmueller-msft commented Mar 15, 2026 •
edited
Loading

Summary

  • Adds "tar": "^7.5.11" pnpm override across 7 workspaces (root, build-tools, common-utils, protocol-definitions, routerlicious, historian, gitrest) to resolve path traversal vulnerabilities in tar <7.5.11
  • Fixes a pre-existing js-yaml integrity hash mismatch in the build-tools test fixture lockfile (js-yaml 3.14.1 → 3.14.2, matching the js-yaml override already in place)
  • No code changes — config and lockfile updates only

Test plan

  • CI passes for all affected workspaces (client packages, build-tools, common-utils, protocol-definitions, server-gitrest, server-historian, server-routerlicious, repo-policy-check)
  • Unaffected workspaces correctly skipped (eslint-config-fluid, build-common, benchmark-tool, api-markdown-documenter, eslint-plugin-fluid, test-tools)
  • No functional changes — overrides only affect transitive dependency resolution

🤖 Generated with Claude Code

frankmueller-msft and others added 4 commits March 15, 2026 11:25
@frankmueller-msft @claude
Override tar to >=7.5.11 across all workspaces to fix path traversal …
d06c653 
…vulnerabilities

tar 6.x is EOL with no security backports. This adds pnpm overrides to the 6
isolated workspaces that still resolved tar 6.2.1, and bumps the existing root
override from >=7.5.7 to >=7.5.11 to cover all known CVEs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@frankmueller-msft @claude
Update test fixture lockfile to remove js-yaml 3.14.1
a411603 
CG was scanning this test data lockfile and flagging the vulnerable
js-yaml 3.14.1 version. Updated references to 3.14.2.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@frankmueller-msft @claude
Use ^7.5.11 instead of >=7.5.11 for tar override to fix syncpack lint
2cb6f31 
syncpack lint-semver-ranges in build-tools rejects >= ranges. Switch to
^ which is semantically equivalent for the 7.x line.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@frankmueller-msft @claude
Fix js-yaml@3.14.2 integrity hash in test fixture lockfile
7f8ae13 
The integrity hash for js-yaml@3.14.2 in the test fixture was incorrect,
causing pnpm install to fail during build-tools tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings March 15, 2026 18:56
Copilot AI reviewed Mar 15, 2026
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates pnpm overrides and lockfiles to move off vulnerable tar 6.x by pinning tar to the 7.5.11 release line across the repo (including per-workspace lockfiles), keeping dependency graphs aligned for server and build tooling packages.

Changes:

  • Add/adjust pnpm overrides to force tar to 7.5.11 across root + affected workspaces.
  • Regenerate/update pnpm lockfiles so tar@7.5.11 (and its new transitive deps) are captured.
  • Update build-infrastructure test lockfile fixture to reflect js-yaml@3.14.2.

Reviewed changes

Copilot reviewed 7 out of 15 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
package.json Updates root pnpm override to tar@^7.5.11.
pnpm-lock.yaml Updates root lockfile to resolve tar@7.5.11 and reflect refreshed dependency graph.
build-tools/package.json Adds tar override + override comment in build-tools workspace.
build-tools/pnpm-lock.yaml Updates build-tools lockfile to include tar@7.5.11 and transitive deps.
build-tools/packages/build-infrastructure/src/test/data/testRepo/pnpm-lock.yaml Updates test fixture lockfile for js-yaml resolution.
common/lib/common-utils/package.json Adds tar override + override comment for common-utils workspace.
common/lib/common-utils/pnpm-lock.yaml Updates common-utils lockfile for tar@7.5.11 graph.
common/lib/protocol-definitions/package.json Adds tar override + override comment for protocol-definitions workspace.
common/lib/protocol-definitions/pnpm-lock.yaml Updates protocol-definitions lockfile for tar@7.5.11 graph.
server/gitrest/package.json Adds tar override + override comment for gitrest workspace.
server/gitrest/pnpm-lock.yaml Updates gitrest lockfile for tar@7.5.11 graph.
server/historian/package.json Adds tar override + override comment for historian workspace.
server/historian/pnpm-lock.yaml Updates historian lockfile for tar@7.5.11 graph.
server/routerlicious/package.json Adds tar override + override comment for routerlicious workspace.
server/routerlicious/pnpm-lock.yaml Updates routerlicious lockfile for tar@7.5.11 graph.
Files not reviewed (8)
  • build-tools/packages/build-infrastructure/src/test/data/testRepo/pnpm-lock.yaml: Language not supported
  • build-tools/pnpm-lock.yaml: Language not supported
  • common/lib/common-utils/pnpm-lock.yaml: Language not supported
  • common/lib/protocol-definitions/pnpm-lock.yaml: Language not supported
  • pnpm-lock.yaml: Language not supported
  • server/gitrest/pnpm-lock.yaml: Language not supported
  • server/historian/pnpm-lock.yaml: Language not supported
  • server/routerlicious/pnpm-lock.yaml: Language not supported

You can also share your feedback on Copilot code review. Take the survey.

server/routerlicious/package.json Outdated
"systeminformation: overridden to ^5.31.0 to resolve command injection vulnerabilities.",
"simple-git: overridden to ^3.32.3 to resolve a CG alert."
"simple-git: overridden to ^3.32.3 to resolve a CG alert.",
"tar: overridden to >=7.5.11 to resolve multiple security vulnerabilities in tar 6.x (EOL, no backport)."
Copy link
Contributor Author

@frankmueller-msft frankmueller-msft Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed — updated all 6 commentsOverrides to say ^7.5.11 to match the actual override range.

server/historian/package.json Outdated
"js-yaml: overridden to fix a known vulnerability (prototype pollution via merge keys).",
"simple-git: overridden to ^3.32.3 to resolve a CG alert."
"simple-git: overridden to ^3.32.3 to resolve a CG alert.",
"tar: overridden to >=7.5.11 to resolve multiple security vulnerabilities in tar 6.x (EOL, no backport)."
Copy link
Contributor Author

@frankmueller-msft frankmueller-msft Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the same commit — all commentsOverrides now say ^7.5.11.

server/gitrest/package.json Outdated
"js-yaml: overridden to fix a known vulnerability (prototype pollution via merge keys).",
"simple-git: overridden to ^3.32.3 to resolve a CG alert."
"simple-git: overridden to ^3.32.3 to resolve a CG alert.",
"tar: overridden to >=7.5.11 to resolve multiple security vulnerabilities in tar 6.x (EOL, no backport)."
Copy link
Contributor Author

@frankmueller-msft frankmueller-msft Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the same commit — all commentsOverrides now say ^7.5.11.

common/lib/protocol-definitions/package.json Outdated
"js-yaml: overridden to fix a known vulnerability (prototype pollution via merge keys).",
"simple-git: overridden to ^3.32.3 to resolve a CG alert."
"simple-git: overridden to ^3.32.3 to resolve a CG alert.",
"tar: overridden to >=7.5.11 to resolve multiple security vulnerabilities in tar 6.x (EOL, no backport)."
Copy link
Contributor Author

@frankmueller-msft frankmueller-msft Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the same commit — all commentsOverrides now say ^7.5.11.

common/lib/common-utils/package.json Outdated
"js-yaml: overridden to fix a known vulnerability (prototype pollution via merge keys).",
"simple-git: overridden to ^3.32.3 to resolve a CG alert."
"simple-git: overridden to ^3.32.3 to resolve a CG alert.",
"tar: overridden to >=7.5.11 to resolve multiple security vulnerabilities in tar 6.x (EOL, no backport)."
Copy link
Contributor Author

@frankmueller-msft frankmueller-msft Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the same commit — all commentsOverrides now say ^7.5.11.

build-tools/package.json Outdated
"mdast-util-to-hast: overridden to ^13.2.1 to fix a known vulnerability (unsanitized class attribute injection).",
"simple-git: overridden to ^3.32.3 to resolve a CG alert."
"simple-git: overridden to ^3.32.3 to resolve a CG alert.",
"tar: overridden to >=7.5.11 to resolve multiple security vulnerabilities in tar 6.x (EOL, no backport)."
Copy link
Contributor Author

@frankmueller-msft frankmueller-msft Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the same commit — all commentsOverrides now say ^7.5.11.

This was referenced Mar 15, 2026
Merged
Closed
@frankmueller-msft @claude
Fix tar override comment to match actual semver range (^7.5.11)
9efdf85 
The commentsOverrides said >=7.5.11 but the actual override uses ^7.5.11.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@frankmueller-msft frankmueller-msft merged commit 523c3c0 into main Mar 16, 2026
59 checks passed
@frankmueller-msft frankmueller-msft deleted the fix/tar-security-override branch March 16, 2026 19:55
frankmueller-msft added a commit that referenced this pull request Mar 16, 2026
@frankmueller-msft @claude
Upgrade npm-check-updates to v17 in build-cli (#26732)
ad7bed2 
## Summary
- Upgrades `npm-check-updates` from v16 to v17 in
`@fluid-tools/build-cli`
- ncu@17 is fully bundled with zero dependencies, eliminating the
transitive `tar 6.x` chain (`ncu@16 → pacote → cacache → tar 6.x`)
- Removes deep type imports (`build/src/types/`) that no longer exist in
v17
- Improves type safety of the `ncu.run()` result: typed as `unknown` and
narrowed per branch (`Record<string, Record<string, string>>` for glob
patterns, `Record<string, string>` for single-package)

## Context
Split from #26707. The tar override fix is in #26731 (pure config, no
code changes). This PR contains the ncu upgrade with a code change in
`build-cli/src/library/package.ts`.

Once published in the next build-cli release, the tar overrides in
non-root workspaces (which exist because they depend on published
`@fluid-tools/build-cli@0.63.0` that still ships ncu@16) can be removed.

## Test plan
- [x] CI passes — build-tools workspace builds and tests successfully
(first push)
- [ ] CI passes after type-narrowing follow-up commit (pending)
- [ ] Verify build-cli commands that use ncu (e.g., `flub check policy`)
still work correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@Abe27342 Abe27342 Abe27342 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@frankmueller-msft @Abe27342