Hold tar at one version, past the advisories - #37
Merged
Conversation
The tree carried three copies, pulled in by cacache, app-builder-lib and
node-gyp, and the older two are what the open tar alerts name. A single
resolution collapses them:
"tar@npm:^7.5.22":
version: 7.5.22
Nothing vulnerable is left in the lockfile, which is what Dependabot
reads. Whether it also shrinks the package is a different question with
a different answer: excluding node-gyp from files is what changes that.
package.json already resolves ip-address and node-abi the same way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thirteen of the open alerts are on
tar, including the one marked critical, and all of them arrive through the node-gyp subtree that the packaged app carries.The tree held three copies:
The highest fix version the open alerts ask for is 7.5.21, and 7.5.22 is current, so one resolution covers all three. After it:
package.jsonalready resolvesip-addressandnode-abithis way.What this does not do
It does not make the package smaller, and it does not stop the app shipping code it never runs. Dependabot reads the lockfile, so this changes what the list says;
filesinelectron-builder.ymlis what changes what a user gets. Those are separate, and this is the first of the two.What was run
Lint, typecheck, the unit tests, and a packaged run of the navigation spec, since
tarsits in the path electron-builder and node-gyp both use. The full matrix runs on this branch.