From fb63dd01d30337e3cac4d12b46fe1e05b3bee0ad Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Thu, 6 Aug 2026 11:10:09 +0000 Subject: [PATCH] fix(deps): keep tar 6 for @electron/rebuild so packaging still works Bumping tar across the 6.x major to clear GHSA-23hp-3jrh-7fpw broke the desktop release. @electron/rebuild does a default import: import tar from 'tar'; tar 6 is CommonJS and satisfies that. tar 7 is ESM with named exports only, so every platform died before it built anything: SyntaxError: The requested module 'tar' does not provide an export named 'default' Pin tar back to ^6.2.1 for @electron/rebuild alone. It is build tooling and never enters the production graph, so `pnpm audit --prod` still reports zero criticals; everything that ships stays on tar 7.5.22. This was missed because `pnpm build` does not invoke electron-builder. Only the package step does, and that runs solely in CI, so the whole pre-commit gauntlet passed on a tree that could not be packaged. Verified this time by running the packaging itself: @electron/rebuild now executes instead of failing to load. Co-Authored-By: Claude Opus 5 (1M context) --- package.json | 3 ++- pnpm-lock.yaml | 25 +++++++++++++++++++++++-- 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index 2772ed5..4b91fb4 100644 --- a/package.json +++ b/package.json @@ -106,7 +106,8 @@ "picomatch@2": "^2.3.2", "form-data@2": "^2.5.4", "tar@6": "^7.5.19", - "tar@7": "^7.5.19" + "tar@7": "^7.5.19", + "@electron/rebuild>tar": "^6.2.1" } }, "dependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2774322..ee59090 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -22,6 +22,7 @@ overrides: form-data@2: ^2.5.4 tar@6: ^7.5.19 tar@7: ^7.5.19 + '@electron/rebuild>tar': ^6.2.1 importers: @@ -6536,6 +6537,10 @@ packages: resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==} engines: {node: '>=8'} + minipass@5.0.0: + resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==} + engines: {node: '>=8'} + minipass@7.1.2: resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==} engines: {node: '>=16 || 14 >=14.17'} @@ -8118,6 +8123,11 @@ packages: resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==} engines: {node: '>=6'} + tar@6.2.1: + resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==} + engines: {node: '>=10'} + deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me + tar@7.5.22: resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==} engines: {node: '>=18'} @@ -10437,7 +10447,7 @@ snapshots: ora: 5.4.1 read-binary-file-arch: 1.0.6 semver: 7.8.5 - tar: 7.5.22 + tar: 6.2.1 yargs: 17.7.3 transitivePeerDependencies: - bluebird @@ -10457,7 +10467,7 @@ snapshots: ora: 5.4.1 read-binary-file-arch: 1.0.6 semver: 7.7.3 - tar: 7.5.22 + tar: 6.2.1 yargs: 17.7.2 transitivePeerDependencies: - supports-color @@ -16312,6 +16322,8 @@ snapshots: dependencies: yallist: 4.0.0 + minipass@5.0.0: {} + minipass@7.1.2: {} minizlib@2.1.2: @@ -18047,6 +18059,15 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 + tar@6.2.1: + dependencies: + chownr: 2.0.0 + fs-minipass: 2.1.0 + minipass: 5.0.0 + minizlib: 2.1.2 + mkdirp: 1.0.4 + yallist: 4.0.0 + tar@7.5.22: dependencies: '@isaacs/fs-minipass': 4.0.1