Skip to content

Update transitive dependency "tar" to latest version#5442

Merged
tdonohue merged 1 commit intoDSpace:mainfrom
tdonohue:update_tar
Apr 9, 2026
Merged

Update transitive dependency "tar" to latest version#5442
tdonohue merged 1 commit intoDSpace:mainfrom
tdonohue:update_tar

Conversation

@tdonohue
Copy link
Copy Markdown
Member

@tdonohue tdonohue commented Apr 8, 2026

References

Description

This small PR updates the transitive dependency tar to the latest version.

This PR was auto-generated locally by running npm update tar.

It's a follow-up to #5417 because that PR was upgrading copy-webpack-plugin to solve several tar-related development environment CVEs. There's a few of those CVEs which are still being detected by GitHub dependabot because tar is still being pulled in as a transitive dependency of a few other transitive dependencies.

This PR therefore updates tar to the latest version in our package-lock.json.

Instructions for Reviewers

  • Verify all tests pass (this will be the best validation test)
  • Optionally deploy locally and verify no obvious issues arise.
    • UPDATE: I've deployed this locally and found no issues.

@tdonohue tdonohue added this to the 10.0 milestone Apr 8, 2026
@tdonohue tdonohue added dependencies Pull requests that update a dependency file 1 APPROVAL pull request only requires a single approval to merge port to dspace-9_x This PR needs to be ported to `dspace-9_x` branch for next bug-fix release labels Apr 8, 2026
@tdonohue tdonohue moved this to 🙋 Needs Reviewers Assigned in DSpace 10.0 Release Apr 8, 2026
@tdonohue
Copy link
Copy Markdown
Member Author

tdonohue commented Apr 9, 2026

Merging as this was an update automated by running npm update tar. I've also tested this thoroughly locally and found no issues.

@tdonohue tdonohue merged commit a154c71 into DSpace:main Apr 9, 2026
16 checks passed
@github-project-automation github-project-automation bot moved this from 🙋 Needs Reviewers Assigned to ✅ Done in DSpace 10.0 Release Apr 9, 2026
@dspace-bot
Copy link
Copy Markdown
Contributor

Backport failed for dspace-9_x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin dspace-9_x
git worktree add -d .worktree/backport-5442-to-dspace-9_x origin/dspace-9_x
cd .worktree/backport-5442-to-dspace-9_x
git switch --create backport-5442-to-dspace-9_x
git cherry-pick -x d06859672a8f8d5cc8c062ab34f055631c179c79

@tdonohue
Copy link
Copy Markdown
Member Author

tdonohue commented Apr 9, 2026

Ported to 9.x in #5460

@tdonohue tdonohue removed the port to dspace-9_x This PR needs to be ported to `dspace-9_x` branch for next bug-fix release label Apr 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

1 APPROVAL pull request only requires a single approval to merge dependencies Pull requests that update a dependency file

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

2 participants