Open
Conversation
Resolves GHSA-9ppj-qmqm-q256 by overriding the tar dependency version used by nested dependencies to 7.5.11 via Yarn resolutions.
There was a problem hiding this comment.
Pull request overview
This PR addresses GHSA-9ppj-qmqm-q256 by forcing the tar package version via Yarn resolutions, and regenerates yarn.lock with yarn dedupe to reduce duplicate transitive dependencies.
Changes:
- Add a Yarn resolution to pin
tarto7.5.11. - Regenerate/dedupe
yarn.lock, resulting in consolidated and updated transitive dependency entries.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds tar@7.5.11 under resolutions to override transitive dependency versions. |
| yarn.lock | Reflects the tar@7.5.11 override and dependency deduplication/reshaping from Yarn. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Resolves type mismatch errors introduced by stricter types in acorn-walk after deduplication. acorn-walk expects acorn.Node, while our parser (meriyah) yields ESTree.Node, leading to TS compilation failures in visitors and `walk` calls. This adds `src/util/walk.ts` which provides `walkSimple` and `walkAncestor` wrappers that map ESTree types safely without relying on inline `as any` type casting.
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves GHSA-9ppj-qmqm-q256 by overriding the tar dependency version used by nested dependencies to 7.5.11 via Yarn resolutions.
Also, yarn dedupe. I forgot to do it last time and we got a lot of duplicated dependencies.