Merge pull request #392 from guardian/sh/address-tar-vulnerable-dependency

twrichards · web-flow · commit 1175238c1498 · 2026-02-27T07:30:50.000Z
Bumps ts-node-dev to latest and adds resolution for vulnerable tar de…
diff --git a/archiver-lambda/package.json b/archiver-lambda/package.json
@@ -11,7 +11,7 @@
   },
   "devDependencies": {
     "@aws-sdk/client-lambda": "^3.995.0",
-    "ts-node-dev": "^1.0.0"
+    "ts-node-dev": "^2.0.0"
   },
   "dependencies": {
     "postgres": "^3.2.4"
diff --git a/bootstrapping-lambda/package.json b/bootstrapping-lambda/package.json
@@ -22,7 +22,7 @@
     "jest": "^29.3.1",
     "ts-jest": "^29.0.3",
     "ts-node": "^10.9.1",
-    "ts-node-dev": "^1.0.0"
+    "ts-node-dev": "^2.0.0"
   },
   "dependencies": {
     "@codegenie/serverless-express": "^4.16.0",
diff --git a/database-bridge-lambda/package.json b/database-bridge-lambda/package.json
@@ -10,7 +10,7 @@
     "watch": "ts-node-dev --respawn run.ts"
   },
   "devDependencies": {
-    "ts-node-dev": "^1.0.0"
+    "ts-node-dev": "^2.0.0"
   },
   "dependencies": {
     "postgres": "^3.2.4"
diff --git a/email-lambda/package.json b/email-lambda/package.json
@@ -13,7 +13,7 @@
     "@aws-sdk/client-lambda": "^3.995.0",
     "@aws-sdk/client-ses": "^3.995.0",
     "@types/react": "16.9.56",
-    "ts-node-dev": "^1.0.0"
+    "ts-node-dev": "^2.0.0"
   },
   "dependencies": {
     "postgres": "^3.2.4",
diff --git a/notifications-lambda/package.json b/notifications-lambda/package.json
@@ -11,7 +11,7 @@
   },
   "devDependencies": {
     "@types/web-push": "^3.3.2",
-    "ts-node-dev": "^1.1.8"
+    "ts-node-dev": "^2.0.0"
   },
   "dependencies": {
     "web-push": "^3.5.0"
diff --git a/package.json b/package.json
@@ -63,7 +63,8 @@
   },
   "resolutions": {
     "cdk@1.0.0/cross-spawn": "^7.0.5",
-    "client@1.0.0/cross-spawn": "^7.0.5"
+    "client@1.0.0/cross-spawn": "^7.0.5",
+    "tar": "^7.5.9"
   },
   "lint-staged": {
     "**/*.{ts, tsx}": "eslint --fix",
diff --git a/users-refresher-lambda/package.json b/users-refresher-lambda/package.json
@@ -13,7 +13,7 @@
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
     "@types/iniparser": "^0.0.29",
-    "ts-node-dev": "^1.0.0"
+    "ts-node-dev": "^2.0.0"
   },
   "dependencies": {
     "@googleapis/admin": "9.0.1",
diff --git a/yarn.lock b/yarn.lock
@@ -3955,6 +3955,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@isaacs/fs-minipass@npm:^4.0.0":
+  version: 4.0.1
+  resolution: "@isaacs/fs-minipass@npm:4.0.1"
+  dependencies:
+    minipass: "npm:^7.0.4"
+  checksum: 10c0/c25b6dc1598790d5b55c0947a9b7d111cfa92594db5296c3b907e2f533c033666f692a3939eadac17b1c7c40d362d0b0635dc874cbfe3e70db7c2b07cc97a5d2
+  languageName: node
+  linkType: hard
+
 "@istanbuljs/load-nyc-config@npm:^1.0.0":
   version: 1.1.0
   resolution: "@istanbuljs/load-nyc-config@npm:1.1.0"
@@ -6726,7 +6735,7 @@ __metadata:
   dependencies:
     "@aws-sdk/client-lambda": "npm:^3.995.0"
     postgres: "npm:^3.2.4"
-    ts-node-dev: "npm:^1.0.0"
+    ts-node-dev: "npm:^2.0.0"
   languageName: unknown
   linkType: soft
 
@@ -7270,7 +7279,7 @@ __metadata:
     jose: "npm:^4.3.7"
     ts-jest: "npm:^29.0.3"
     ts-node: "npm:^10.9.1"
-    ts-node-dev: "npm:^1.0.0"
+    ts-node-dev: "npm:^2.0.0"
   languageName: unknown
   linkType: soft
 
@@ -7622,10 +7631,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"chownr@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "chownr@npm:2.0.0"
-  checksum: 10c0/594754e1303672171cc04e50f6c398ae16128eb134a88f801bf5354fd96f205320f23536a045d9abd8b51024a149696e51231565891d4efdab8846021ecf88e6
+"chownr@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "chownr@npm:3.0.0"
+  checksum: 10c0/43925b87700f7e3893296c8e9c56cc58f926411cce3a6e5898136daaf08f08b9a8eb76d37d3267e707d0dcc17aed2e2ebdf5848c0c3ce95cf910a919935c1b10
   languageName: node
   linkType: hard
 
@@ -8304,7 +8313,7 @@ __metadata:
   resolution: "database-bridge-lambda@workspace:database-bridge-lambda"
   dependencies:
     postgres: "npm:^3.2.4"
-    ts-node-dev: "npm:^1.0.0"
+    ts-node-dev: "npm:^2.0.0"
   languageName: unknown
   linkType: soft
 
@@ -8741,7 +8750,7 @@ __metadata:
     preact-render-to-string: "npm:^6.0.3"
     react: "npm:@preact/compat@*"
     react-dom: "npm:@preact/compat@*"
-    ts-node-dev: "npm:^1.0.0"
+    ts-node-dev: "npm:^2.0.0"
   languageName: unknown
   linkType: soft
 
@@ -9909,15 +9918,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-minipass@npm:^2.0.0":
-  version: 2.1.0
-  resolution: "fs-minipass@npm:2.1.0"
-  dependencies:
-    minipass: "npm:^3.0.0"
-  checksum: 10c0/703d16522b8282d7299337539c3ed6edddd1afe82435e4f5b76e34a79cd74e488a8a0e26a636afc2440e1a23b03878e2122e3a2cfe375a5cf63c37d92b86a004
-  languageName: node
-  linkType: hard
-
 "fs-minipass@npm:^3.0.0":
   version: 3.0.3
   resolution: "fs-minipass@npm:3.0.3"
@@ -12766,7 +12766,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimist@npm:^1.2.0, minimist@npm:^1.2.5":
+"minimist@npm:^1.2.0, minimist@npm:^1.2.5, minimist@npm:^1.2.6":
   version: 1.2.8
   resolution: "minimist@npm:1.2.8"
   checksum: 10c0/19d3fcdca050087b84c2029841a093691a91259a47def2f18222f41e7645a0b7c44ef4b40e88a1e58a40c84d2ef0ee6047c55594d298146d0eb3f6b737c20ce6
@@ -12833,21 +12833,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minipass@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "minipass@npm:5.0.0"
-  checksum: 10c0/a91d8043f691796a8ac88df039da19933ef0f633e3d7f0d35dcd5373af49131cf2399bfc355f41515dc495e3990369c3858cd319e5c2722b4753c90bf3152462
-  languageName: node
-  linkType: hard
-
-"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.1.2":
-  version: 7.1.2
-  resolution: "minipass@npm:7.1.2"
-  checksum: 10c0/b0fd20bb9fb56e5fa9a8bfac539e8915ae07430a619e4b86ff71f5fc757ef3924b23b2c4230393af1eda647ed3d75739e4e0acb250a6b1eb277cf7f8fe449557
+"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.0.4, minipass@npm:^7.1.2":
+  version: 7.1.3
+  resolution: "minipass@npm:7.1.3"
+  checksum: 10c0/539da88daca16533211ea5a9ee98dc62ff5742f531f54640dd34429e621955e91cc280a91a776026264b7f9f6735947629f920944e9c1558369e8bf22eb33fbb
   languageName: node
   linkType: hard
 
-"minizlib@npm:^2.1.1, minizlib@npm:^2.1.2":
+"minizlib@npm:^2.1.2":
   version: 2.1.2
   resolution: "minizlib@npm:2.1.2"
   dependencies:
@@ -12857,7 +12850,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mkdirp@npm:^1.0.3, mkdirp@npm:^1.0.4":
+"minizlib@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "minizlib@npm:3.1.0"
+  dependencies:
+    minipass: "npm:^7.1.2"
+  checksum: 10c0/5aad75ab0090b8266069c9aabe582c021ae53eb33c6c691054a13a45db3b4f91a7fb1bd79151e6b4e9e9a86727b522527c0a06ec7d45206b745d54cd3097bcec
+  languageName: node
+  linkType: hard
+
+"mkdirp@npm:^1.0.4":
   version: 1.0.4
   resolution: "mkdirp@npm:1.0.4"
   bin:
@@ -13092,7 +13094,7 @@ __metadata:
   resolution: "notifications-lambda@workspace:notifications-lambda"
   dependencies:
     "@types/web-push": "npm:^3.3.2"
-    ts-node-dev: "npm:^1.1.8"
+    ts-node-dev: "npm:^2.0.0"
     web-push: "npm:^3.5.0"
   languageName: unknown
   linkType: soft
@@ -15676,17 +15678,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:^6.1.11, tar@npm:^6.1.2":
-  version: 6.2.1
-  resolution: "tar@npm:6.2.1"
+"tar@npm:^7.5.9":
+  version: 7.5.9
+  resolution: "tar@npm:7.5.9"
   dependencies:
-    chownr: "npm:^2.0.0"
-    fs-minipass: "npm:^2.0.0"
-    minipass: "npm:^5.0.0"
-    minizlib: "npm:^2.1.1"
-    mkdirp: "npm:^1.0.3"
-    yallist: "npm:^4.0.0"
-  checksum: 10c0/a5eca3eb50bc11552d453488344e6507156b9193efd7635e98e867fab275d527af53d8866e2370cd09dfe74378a18111622ace35af6a608e5223a7d27fe99537
+    "@isaacs/fs-minipass": "npm:^4.0.0"
+    chownr: "npm:^3.0.0"
+    minipass: "npm:^7.1.2"
+    minizlib: "npm:^3.1.0"
+    yallist: "npm:^5.0.0"
+  checksum: 10c0/e870beb1b2477135ca2abe86b2d18f7b35d0a4e3a37bbc523d3b8f7adca268dfab543f26528a431d569897f8c53a7cac745cdfbc4411c2f89aeeacc652b81b0a
   languageName: node
   linkType: hard
 
@@ -15938,19 +15939,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ts-node-dev@npm:^1.0.0, ts-node-dev@npm:^1.1.8":
-  version: 1.1.8
-  resolution: "ts-node-dev@npm:1.1.8"
+"ts-node-dev@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "ts-node-dev@npm:2.0.0"
   dependencies:
     chokidar: "npm:^3.5.1"
     dynamic-dedupe: "npm:^0.3.0"
-    minimist: "npm:^1.2.5"
+    minimist: "npm:^1.2.6"
     mkdirp: "npm:^1.0.4"
     resolve: "npm:^1.0.0"
     rimraf: "npm:^2.6.1"
     source-map-support: "npm:^0.5.12"
     tree-kill: "npm:^1.2.2"
-    ts-node: "npm:^9.0.0"
+    ts-node: "npm:^10.4.0"
     tsconfig: "npm:^7.0.0"
   peerDependencies:
     node-notifier: "*"
@@ -15961,7 +15962,7 @@ __metadata:
   bin:
     ts-node-dev: lib/bin.js
     tsnd: lib/bin.js
-  checksum: 10c0/72d17b916ead2b3a1a8ec123bc093b0fb2363af54722fed1a5305336ccdfb716125ec6f14c29a11958d360a4d1f726ef5c9d3033093999ab2e7cdff11c0075f5
+  checksum: 10c0/34f81407ede9284eccf47139e22bc85511c6d70e2b8dfae91c917ababc09ba947cc0791549ee7b2e5a69d26de40eedb23c6bdb4fac689ed07a302813bf966faa
   languageName: node
   linkType: hard
 
@@ -15985,9 +15986,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ts-node@npm:^10.9.1":
-  version: 10.9.1
-  resolution: "ts-node@npm:10.9.1"
+"ts-node@npm:^10.4.0, ts-node@npm:^10.9.1":
+  version: 10.9.2
+  resolution: "ts-node@npm:10.9.2"
   dependencies:
     "@cspotcode/source-map-support": "npm:^0.8.0"
     "@tsconfig/node10": "npm:^1.0.7"
@@ -16019,28 +16020,7 @@ __metadata:
     ts-node-script: dist/bin-script.js
     ts-node-transpile-only: dist/bin-transpile.js
     ts-script: dist/bin-script-deprecated.js
-  checksum: 10c0/95187932fb83f3901e22546bd2feeac7d2feb4f412f42ac3a595f049a23e8dcf70516dffb51866391228ea2dbcfaea039e250fb2bb334d48a86ab2b6aea0ae2d
-  languageName: node
-  linkType: hard
-
-"ts-node@npm:^9.0.0":
-  version: 9.1.1
-  resolution: "ts-node@npm:9.1.1"
-  dependencies:
-    arg: "npm:^4.1.0"
-    create-require: "npm:^1.1.0"
-    diff: "npm:^4.0.1"
-    make-error: "npm:^1.1.1"
-    source-map-support: "npm:^0.5.17"
-    yn: "npm:3.1.1"
-  peerDependencies:
-    typescript: ">=2.7"
-  bin:
-    ts-node: dist/bin.js
-    ts-node-script: dist/bin-script.js
-    ts-node-transpile-only: dist/bin-transpile.js
-    ts-script: dist/bin-script-deprecated.js
-  checksum: 10c0/e0f904090aba4b3496fdfca640cfd92c1f5a41fa303b0ccb40f49be160699687a97a4dd5f57200646a3b83528952611d1c5ad5804ee25f338b017e7b1c13f0f4
+  checksum: 10c0/5f29938489f96982a25ba650b64218e83a3357d76f7bede80195c65ab44ad279c8357264639b7abdd5d7e75fc269a83daa0e9c62fd8637a3def67254ecc9ddc2
   languageName: node
   linkType: hard
 
@@ -16413,7 +16393,7 @@ __metadata:
     "@types/iniparser": "npm:^0.0.29"
     iniparser: "npm:^1.0.5"
     postgres: "npm:^3.2.4"
-    ts-node-dev: "npm:^1.0.0"
+    ts-node-dev: "npm:^2.0.0"
   languageName: unknown
   linkType: soft
 
@@ -17043,6 +17023,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"yallist@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "yallist@npm:5.0.0"
+  checksum: 10c0/a499c81ce6d4a1d260d4ea0f6d49ab4da09681e32c3f0472dee16667ed69d01dae63a3b81745a24bd78476ec4fcf856114cb4896ace738e01da34b2c42235416
+  languageName: node
+  linkType: hard
+
 "yaml-ast-parser@npm:^0.0.43":
   version: 0.0.43
   resolution: "yaml-ast-parser@npm:0.0.43"
