chore(deps): bump fast-uri to 3.1.4, tar to 7.5.22, drop 8 exclusions#9355
Open
github-actions[bot] wants to merge 1 commit into
Open
chore(deps): bump fast-uri to 3.1.4, tar to 7.5.22, drop 8 exclusions#9355github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
… from osv-scanner.toml - fast-uri: 3.1.3 → 3.1.4 (resolves GHSA-v2hh-gcrm-f6hx host confusion vulnerability) - tar resolutions: 6.2.1 → 7.5.22 for swarm-js, yeoman-generator, and pacote paths - Remove 8 stale osv-scanner exclusions: • GHSA-v2hh-gcrm-f6hx (fast-uri host confusion, fixed in 3.1.4) • GHSA-8qq5-rm4j-mr97 (tar symlink/hardlink, fixed in 7.5.3+) • GHSA-r6q2-hw4h-h46w (tar extraction CVE, fixed in 7.5.4+) • GHSA-34x7-hfp2-rc4v (tar crafted archives, fixed in 7.5.4+) • GHSA-83g3-92jg-28cx (tar crafted archives, fixed in 7.5.4+) • GHSA-qffp-2rhf-9h96 (tar hardlink traversal, fixed in 7.5.7+) • GHSA-9ppj-qmqm-q256 (tar extraction CVE) • GHSA-23hp-3jrh-7fpw (tar decompression DoS, fixed in 7.5.19+) • GHSA-8x88-c5mf-7j5w (tar infinite loop, fixed in 7.5.18+) All fixes verified with osv-scanner and check-deps passes. Ticket: HSM-429
github-actions
Bot
requested review from
Charan-Ratlan and
mohammadalfaiyazbitgo
July 27, 2026 07:25
github-actions
Bot
added
automated
sijuu
approved these changes
Jul 27, 2026
Contributor
|
NACK — CI is failing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removed exclusions
Verification
✅ OSV Scanner: All removed exclusions no longer flagged
✅ check-deps: Cross-workspace version consistency verified
✅ Dependencies: All resolutions upgraded successfully
Still blocked
These exclusions remain in place due to compatibility constraints:
🤖 Generated with Claude Code