chore: fix critical issue in tar npm package

[borosr]

Overview

Fixes #(issue)

Notes for reviewer

Summary by CodeRabbit

• Chores
  • Updated internal package version controls by refining maturity-gate exclusions and expanding pinned dependency overrides.
  • Improves build consistency and stability with no user-facing features or behavior changes included.

Greptile Summary

This PR updates the API specification workspace dependencies to address security advisories. The main changes are:

• Adds dependency overrides for tar and other affected packages.
• Refreshes the lockfile with upgraded dependency versions.
• Aligns release-age exclusions with the resolved versions.

Confidence Score: 5/5

This looks safe to merge.

• The release-age exclusions now match the resolved versions associated with the earlier install failure.
• No blocking issue remains in the updated dependency configuration.

Important Files Changed

Filename	Overview
api/spec/pnpm-workspace.yaml	Updates release-age exclusions to match the dependency versions selected by the refreshed lockfile.
api/spec/pnpm-lock.yaml	Adds security overrides and refreshes dependency resolutions, including upgrading tar to 7.5.20.

_{Reviews (2): Last reviewed commit: "fix: greptile comment" | Re-trigger Greptile}

Context used (3)

• Context used - CLAUDE.md (source)
• Context used - AGENTS.md (source)
• Context used - api/spec/AGENTS.md (source)

[coderabbitai]

📝 Walkthrough

Walkthrough

The pnpm workspace configuration adds dependency versions to maturity-gate exclusions and expands override rules for selected packages and version ranges.

Changes

Dependency Resolution Policy

Layer / File(s)	Summary
Dependency resolution rules api/spec/pnpm-workspace.yaml	Adds package/version exclusions to minimumReleaseAgeExclude and enforces additional version selections through overrides.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openmeterio/openmeter#4623: Updates related pnpm dependency gating and override rules.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is relevant to the security fix, and the tar package is one of the main affected dependencies.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/fix-security-check

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

api/spec/pnpm-workspace.yaml (2)

10-25: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Tidy up the redundant exclusions!

It looks like there are a few older versions of tar, dompurify, js-yaml, and protobufjs mixed in here alongside the newer ones. We can safely trim out the older versions to keep the list clean and easy to read.

✨ Proposed cleanup

-  - esbuild@0.28.1
-  - tar@7.5.16
-  - dompurify@3.4.9
-  - '`@opentelemetry/core`@2.8.0'
-  - dompurify@3.4.11
-  - undici@6.27.0
-  - js-yaml@4.1.2
-  - protobufjs@7.6.3
-  - '`@babel/core`@7.29.1'
-  - brace-expansion@2.1.2
-  - brace-expansion@5.0.7
-  - js-yaml@4.3.0
-  - tar@7.5.18
-  - tar@7.5.19
-  - tar@7.5.17
-  - protobufjs@7.6.5
+  - esbuild@0.28.1
+  - '`@opentelemetry/core`@2.8.0'
+  - dompurify@3.4.11
+  - undici@6.27.0
+  - js-yaml@4.3.0
+  - protobufjs@7.6.5
+  - '`@babel/core`@7.29.1'
+  - brace-expansion@2.1.2
+  - brace-expansion@5.0.7
+  - tar@7.5.19

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/spec/pnpm-workspace.yaml` around lines 10 - 25, Remove the older
duplicate exclusions from the workspace exclusions list, retaining only the
newest versions for tar, dompurify, js-yaml, and protobufjs. Keep unrelated
package exclusions unchanged and preserve the existing YAML list structure.

---

40-51: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consolidate overlapping override ranges.

There are a few overlapping ranges here for dompurify, js-yaml, protobufjs, and especially tar. When overrides overlap, it can sometimes make dependency resolution a bit unpredictable.

Consolidating them to just cover the widest range pointing to the latest version makes the config much cleaner and ensures pnpm resolves them exactly how we want!

🛠️ Proposed consolidation

-  dompurify@<3.4.9: ^3.4.9
-  dompurify@<=3.4.10: ^3.4.11
   esbuild@>=0.27.3 <0.28.1: ^0.28.1
-  js-yaml@>=4.0.0 <4.3.0: ^4.3.0
-  js-yaml@>=4.0.0 <=4.1.1: ^4.1.2
-  protobufjs@<=7.6.2: ^7.6.3
-  protobufjs@>=7.5.0 <=7.6.4: ^7.6.5
+  dompurify@<=3.4.10: ^3.4.11
+  js-yaml@>=4.0.0 <4.3.0: ^4.3.0
+  protobufjs@<=7.6.4: ^7.6.5
   'semver@<7.7.4': '>=7.7.4'
-  tar@<=7.5.15: ^7.5.16
-  tar@<=7.5.16: ^7.5.17
-  tar@<=7.5.17: ^7.5.18
-  tar@<=7.5.18: ^7.5.19
+  tar@<=7.5.18: ^7.5.19

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/spec/pnpm-workspace.yaml` around lines 40 - 51, Consolidate overlapping
pnpm overrides for dompurify, js-yaml, protobufjs, and tar into one entry per
package. Use the widest combined matching range for each package and point it to
the latest currently specified target: dompurify ^3.4.11, js-yaml ^4.3.0,
protobufjs ^7.6.5, and tar ^7.5.19; leave unrelated overrides unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@api/spec/pnpm-workspace.yaml`:
- Around line 10-25: Remove the older duplicate exclusions from the workspace
exclusions list, retaining only the newest versions for tar, dompurify, js-yaml,
and protobufjs. Keep unrelated package exclusions unchanged and preserve the
existing YAML list structure.
- Around line 40-51: Consolidate overlapping pnpm overrides for dompurify,
js-yaml, protobufjs, and tar into one entry per package. Use the widest combined
matching range for each package and point it to the latest currently specified
target: dompurify ^3.4.11, js-yaml ^4.3.0, protobufjs ^7.6.5, and tar ^7.5.19;
leave unrelated overrides unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 48b13281-f6ea-476e-8951-06775d1ae318

📥 Commits

Reviewing files that changed from the base of the PR and between 59287dd and 08a9168.

⛔ Files ignored due to path filters (1)

• api/spec/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• api/spec/pnpm-workspace.yaml