Skip to content

fix(security): patch docs tar dependency - #2730

Closed
0xjohnnydev wants to merge 1 commit into
mainfrom
agent/security-docs-tar-20260731
Closed

fix(security): patch docs tar dependency#2730
0xjohnnydev wants to merge 1 commit into
mainfrom
agent/security-docs-tar-20260731

Conversation

@0xjohnnydev

@0xjohnnydev 0xjohnnydev commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

The documentation site was resolving tar 7.5.16 through Tailwind's native build dependency. GitHub Dependabot reports a security alert for that version.

  • Add a focused docs override for tar 7.5.18.
  • Regenerate the docs lockfile so the resolved package and snapshot use the patched release.
  • Keep the change limited to the docs dependency graph.

Validation

  • npx --yes pnpm@9.0.4 install --lockfile-only --ignore-scripts from docs/
  • git diff --check
  • Confirmed docs/pnpm-lock.yaml has no tar@7.5.16 entry.

Definition of Done

  • The visible docs tar alert feat(agent): add GUI-Owl model support #910 is mapped to this focused draft.
  • The docs lock graph resolves tar 7.5.18, outside the reported vulnerable range.
  • A human reviews and merges the draft; this automation does not advance drafts.
  • GitHub closes the alert after the reviewed fix reaches the default branch.

This draft is a duplicate of the existing focused docs dependency draft #2451. Review #2451 instead; this PR is retained as a draft for traceability and will not be advanced by the automation.

@0xjohnnydev

Copy link
Copy Markdown
Contributor Author

Closing this draft because #2451 already owns the same docs tar dependency change. Keeping both would duplicate review and create lockfile conflicts. No code was merged; please continue review on #2451.

@0xjohnnydev 0xjohnnydev closed this Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant