Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TAR-15032660 - https://snyk.io/vuln/SNYK-JS-TAR-15127355
There was a problem hiding this comment.
Pull request overview
Updates node-gyp to remediate Snyk-reported tar directory traversal vulnerabilities in the project’s npm dependency tree.
Changes:
- Bump
node-gypfrom^8.4.1to^11.0.0inpackage.json.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@types/react-router-dom": "^5.1.5", | ||
| "eslint-plugin-jsx-a11y": "^6.3.1", | ||
| "node-gyp": "^8.4.1", | ||
| "node-gyp": "^11.0.0", |
There was a problem hiding this comment.
Upgrading to node-gyp ^11.0.0 is a major-version jump (Snyk flags this PR as a breaking change). This repo currently pins Node 14.11.0 in Dockerfile and the GitHub Actions matrix runs Node 10/12/14; please verify node-gyp 11 supports the project’s supported Node versions. If not, either (a) bump the supported Node versions (and update CI/Dockerfile/docs accordingly) or (b) choose a node-gyp version that still remediates the tar vuln while remaining compatible.
Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-TAR-15032660
SNYK-JS-TAR-15127355
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Directory Traversal
This change is