From 6060d88c5477a0870690aa26ff675a1b552b7f88 Mon Sep 17 00:00:00 2001
From: "Abdullah." <125115953+mabdullahabaid@users.noreply.github.com>
Date: Mon, 27 Jul 2026 12:55:25 +0500
Subject: [PATCH] fix: bump tar 7.5.20 -> 7.5.21 in the root lockfile
 (Dependabot) (#23330)

## Summary

Bumps **tar 7.5.20 -> 7.5.21** in the root `yarn.lock`, clearing
Dependabot alert
[1852](https://github.com/twentyhq/twenty/security/dependabot/1852):
**GHSA-r292-9mhp-454m** (medium) - uncontrolled recursion in
`mapHas`/`filesFilter` allows an uncatchable stack-overflow DoS via a
crafted long-path tar with member selection, vulnerable `<= 7.5.20`.

Every root tar consumer declares a caret range (`^7.4.3`, `^7.5.4`,
`^7.5.9`, `^7.5.11`, `^7.5.16`) and the existing scoped tar resolutions
for the @electron/rebuild toolchain and @mintlify/previewing are carets
as well (`npm:^7.5.16`), so a recursive `yarn up -R tar` lifts the
single tar entry with **no resolution change and no `package.json`
change**.

## Verification

- `yarn install --immutable` passes.
- Diff is `yarn.lock` only; the single tar entry resolves to 7.5.21,
nothing below remains.
- 7.5.21 published 2026-07-21, clears the 3-day npm age gate.

The same advisory affects the twenty-apps and server fixture lockfiles;
those follow in separate PRs.
---
 yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index fdb08fb055..ef2c6597dc 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -48241,15 +48241,15 @@ __metadata:
   linkType: hard
 
 "tar@npm:^7.4.3, tar@npm:^7.5.11, tar@npm:^7.5.16, tar@npm:^7.5.4, tar@npm:^7.5.9":
-  version: 7.5.20
-  resolution: "tar@npm:7.5.20"
+  version: 7.5.21
+  resolution: "tar@npm:7.5.21"
   dependencies:
     "@isaacs/fs-minipass": "npm:^4.0.0"
     chownr: "npm:^3.0.0"
     minipass: "npm:^7.1.2"
     minizlib: "npm:^3.1.0"
     yallist: "npm:^5.0.0"
-  checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
+  checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
   languageName: node
   linkType: hard