Repository navigation
Upgrade giget to v3 to drop vulnerable tar@6.2.1 dependency - #54
Open
fallenprogrammr wants to merge 1 commit into
Open
fallenprogrammr wants to merge 1 commit into
fallenprogrammr wants to merge 1 commit into
Conversation
giget@1.2.5 depends on tar@6.2.1, which has multiple high/critical advisories (path traversal, hardlink/symlink escapes, DoS). giget@3.x dropped the tar dependency entirely (zero runtime deps), so bumping removes the vulnerable code path from every `npx install-mcp` run. giget doesn't appear to be imported anywhere in src/, so this should be a no-op behaviorally; build, typecheck, and test suite all pass.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
giget@1.2.5(declared independencies) pulls intar@6.2.1, which has multiple published high/critical advisories (path traversal via hardlinks/symlinks, decompression DoS, etc.) — npm prints a deprecation/security warning for it on every install.giget@3.3.1(current latest) dropped itstardependency entirely (zero runtime deps), so bumping the version requirement removes the vulnerable transitive dependency from everynpx install-mcpinvocation.gigetdoes not appear to be imported anywhere undersrc/currently, so this should be behaviorally a no-op — happy to also just drop the dependency instead if that's preferred, but kept this as a version bump per the ask.Changes
package.json:giget^1.2.5→^3.3.1bun.lock/package-lock.json: regenerated accordingly (tar@6.2.1no longer present anywhere in the resolved tree apart from an unrelatednpm-bundled copy pulled in transitively bysemantic-release, which is out of scope here)Test plan
bun install— resolves cleanly,tarno longer present undergigetbun run compile— typechecksbun run build— builds successfullybun run test— 7/7 passbun run lint— passes (Biome clean)