houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: bump tar to 7.5.21 across app lockfiles (Dependabot) (#23332)

Browse Source 
## Summary

Bumps **tar -> 7.5.21** in the 13 twenty-apps lockfiles that carry it
transitively, clearing **GHSA-r292-9mhp-454m** (medium) on those
manifests: uncontrolled recursion in `mapHas`/`filesFilter` allows an
uncatchable stack-overflow DoS via a crafted long-path tar with member
selection, vulnerable `<= 7.5.20`.

Apps covered: document-generator, hello-world, postcard, self-hosting,
twenty-partners, call-recorder, people-data-labs, twenty-discord,
twenty-exa, twenty-fireflies, twenty-last-contact, twenty-linear,
twenty-slack.

Every app reaches tar through a caret range (`^7.5.4`), so a recursive
`yarn up -R tar` lifts it in each project with **no resolution and no
`package.json` change** - the diff is 13 `yarn.lock` files and nothing
else.

## Not included

- **Root lockfile**: same advisory, shipped separately in #23330.
- **`application-package/constants/seed-dependencies`**: the 14th
manifest with this advisory. Its `yarn.lock` is checksum-coupled to
`DEFAULT_YARN_LOCK_CHECKSUM`, so it moves in its own PR with the
constant regenerated alongside.

## Verification

- tar resolves to **7.5.21** in all 13 lockfiles; nothing below remains.
- `yarn install --immutable` passes in each of the 13 projects.
- 7.5.21 published 2026-07-21, clears the 3-day npm age gate.
This commit is contained in:
Abdullah.
2026-07-27 12:55:04 +05:00
committed by GitHub
parent ad3291f4b4
commit 155636d7d9
13 changed files with 39 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-apps/examples/document-generator/yarn.lock
+3 -3
View File
@@ -2816,15 +2816,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.19
resolution: "tar@npm:7.5.19"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/7022e8cb04a8ceccc0689f2c731743fa2aab2e3c3f559f7dbc37b65ef7d5913049b427284eded2ec0765c5db5ff72dd7939fe2ae15785ff422cef2116c95d798
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/examples/hello-world/yarn.lock
+3 -3
View File
@@ -2640,15 +2640,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/examples/postcard/yarn.lock
+3 -3
View File
@@ -3009,15 +3009,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/internal/self-hosting/yarn.lock
+3 -3
View File
@@ -3081,15 +3081,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/internal/twenty-partners/yarn.lock
+3 -3
View File
@@ -3376,15 +3376,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/call-recorder/yarn.lock
+3 -3
View File
@@ -3503,15 +3503,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/people-data-labs/yarn.lock
+3 -3
View File
@@ -2730,15 +2730,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/twenty-discord/yarn.lock
+3 -3
View File
@@ -2793,15 +2793,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/twenty-exa/yarn.lock
+3 -3
View File
@@ -2765,15 +2765,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/twenty-fireflies/yarn.lock
+3 -3
View File
@@ -3547,15 +3547,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/twenty-last-contact/yarn.lock
+3 -3
View File
@@ -2748,15 +2748,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/twenty-linear/yarn.lock
+3 -3
View File
@@ -2793,15 +2793,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard
packages/twenty-apps/public/twenty-slack/yarn.lock
+3 -3
View File
@@ -2908,15 +2908,15 @@ __metadata:
linkType: hard
"tar@npm:^7.5.4":
version: 7.5.20
resolution: "tar@npm:7.5.20"
version: 7.5.21
resolution: "tar@npm:7.5.21"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
languageName: node
linkType: hard