fix(deps): resolve node-tar CVE-2026-23745 via electron-builder 26 bump - #163
Merged
Conversation
tar@6.2.1 was pinned transitively by electron-builder 25 (app-builder-lib 25.1.8 directly, and via @electron/rebuild 3.6.1 → node-gyp 9.4.1 → cacache 16.1.3). Bumping @flavian/gui's electron-builder to ^26.0.0 (resolves 26.15.3) moves the whole chain to tar 7.5.22, clearing the High-severity node-tar path-traversal / symlink-poisoning advisories (fixed in tar 7.5.3+). The lockfile refresh also drops the stale electron-builder-squirrel- windows@25.1.8 auto-installed peer in favor of 26.15.3, removing the last tar 6 consumer. Closes #157 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
electron-builder 26 pulls @electron/rebuild 4.x, which declares engines.node >=22.12.0 — with engine-strict=true this makes `pnpm install` fail on Node 20 (as the commitlint CI job showed). Node 20 reached end-of-life in April 2026, so raise the baseline instead of pinning the toolchain back: - engines.node >=22.12.0 in root, @flavian/gui, @flavian/pipeline - all CI workflows on node-version 22 (7 were still on 20) - README / PREREQUISITES / check-prerequisites.sh minimums updated BREAKING CHANGE: Node.js >=22.12.0 is now required (was >=20.0.0). Node 20 is end-of-life and cannot install the electron-builder 26 toolchain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PAMulligan
pushed a commit
that referenced
this pull request
Aug 24, 2026
…+ in-range dep sweep; docs accuracy pass Weekly dependency + security sweep (Wk 3): - esbuild (Dependabot #31, GHSA-67mh-4wv8-2f99): the vulnerable esbuild@0.21.5 was pulled solely by electron-vite@2.3.0. Bump electron-vite to ^5.0.0 (Dec 2025), whose esbuild ^0.25.11 is out of the affected range (<=0.24.2). This also fixes the standing unmet-peer warning: electron-vite 5 accepts vite ^6, matching the installed vite 6.4.3. - tar ×7 (Dependabot #33-#38, #59): already resolved on main by #163 (electron-builder 26 moved the tree to tar 7.5.22 >= 7.5.16). - In-range `pnpm -r update` sweep: clears the remaining transitive audit findings (ws, js-yaml, brace-expansion, fast-uri, ip-address, nanoid, postcss). pnpm audit is down from 20 findings to 1: extract-zip <=2.0.1 (GHSA-jmr9-qjv8-65gv) has no patched release and sits in install-time tooling (electron / puppeteer downloads). - minimumReleaseAge: fast-xml-parser held at ~5.10.1 (2026-07-16); 5.11.0 is only 7 days old. All other resolved versions are 13+ days old. - Docs accuracy pass: README counts verified correct (53 agents, 12 skills, 6 plugins); no version badges exist; install entry points verified (wordpress-local.sh subcommands, flavian CLI, init wizard). Updated 5 stale "Node.js 20+" references in docs/mcp-setup.md, docs/E2E-VALIDATION.md, docs/MCP-TROUBLESHOOTING.md to 22.12+ (baseline raised in #163). Closes #158 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
4 tasks
PAMulligan
pushed a commit
that referenced
this pull request
Aug 24, 2026
… sweep + docs pass Weekly dependency + security sweep (Wk 3): - esbuild (Dependabot #31, GHSA-67mh-4wv8-2f99): the vulnerable esbuild@0.21.5 was pulled solely by electron-vite@2.3.0. Bump electron-vite to ^5.0.0 (Dec 2025), whose esbuild ^0.25.11 is out of the affected range (<=0.24.2). This also fixes the standing unmet-peer warning: electron-vite 5 accepts vite ^6, matching the installed vite 6.4.3. - tar ×7 (Dependabot #33-#38, #59): already resolved on main by #163 (electron-builder 26 moved the tree to tar 7.5.22 >= 7.5.16). - In-range `pnpm -r update` sweep: clears the remaining transitive audit findings (ws, js-yaml, brace-expansion, fast-uri, ip-address, nanoid, postcss). pnpm audit is down from 20 findings to 1: extract-zip <=2.0.1 (GHSA-jmr9-qjv8-65gv) has no patched release and sits in install-time tooling (electron / puppeteer downloads). - minimumReleaseAge: fast-xml-parser held at ~5.10.1 (2026-07-16); 5.11.0 is only 7 days old. All other resolved versions are 13+ days old. - Docs accuracy pass: README counts verified correct (53 agents, 12 skills, 6 plugins); no version badges exist; install entry points verified (wordpress-local.sh subcommands, flavian CLI, init wizard). Updated 5 stale "Node.js 20+" references in docs/mcp-setup.md, docs/E2E-VALIDATION.md, docs/MCP-TROUBLESHOOTING.md to 22.12+ (baseline raised in #163). Closes #158 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the High-severity
node-tarpath-traversal / symlink-poisoning advisories (CVE-2026-23745, Dependabot alert #33) reported in #157. The advisories are fixed in tar 7.5.3+, but tar was transitively pinned at 6.2.1 and could not be bumped directly.Pinning chain identified:
electron-builder@^25.0.0(packages/gui) →app-builder-lib@25.1.8→tar@6.2.1app-builder-lib@25.1.8→@electron/rebuild@3.6.1→node-gyp@9.4.1→cacache@16.1.3→tar@6.2.1These were the only tar consumers in the lockfile.
Fix: bump
electron-builderto^26.0.0(resolves 26.15.3, published 2026-06-09 — well past the release-age cooldown). app-builder-lib 26 declarestar: ^7.5.7and@electron/rebuild@^4→node-gyp@^12→tar: ^7.5.4, so the whole tree now resolves a singletar@7.5.22. The lockfile refresh also replaces the stale auto-installedelectron-builder-squirrel-windows@25.1.8peer with 26.15.3.pnpm auditno longer reports any node-tar advisories (--prodis fully clean). The remaining dev-tooling audit findings (ws, js-yaml, brace-expansion, esbuild-via-vite-5 in electron-vite's chain, …) are outside the scope of #157.The
electron-builder.ymlconfig uses only keys still valid in v26 (nsis/dmg/AppImage targets,signAndEditExecutable), so no config changes were needed.@electron/rebuild@4.x(required by electron-builder 26) declaresengines.node >=22.12.0; with the repo'sengine-strict=true,pnpm installhard-fails on Node 20 (the commitlint CI job caught this on the first push). Node 20 reached end-of-life in April 2026, so this PR raises the baseline rather than pinning the toolchain back:engines.node→>=22.12.0in root,@flavian/gui,@flavian/pipelinenode-version: 20to22docs/PREREQUISITES.md, andscripts/check-prerequisites.shminimums updatedThe second commit carries a
BREAKING CHANGEfooter so release-please cuts a major.Closes #157
Test plan
pnpm gui:test— 53/53 passpnpm gui:typecheck— cleanpnpm gui:lint— cleanpnpm gui:build— buildselectron-builder --version→ 26.15.3 (CLI loads under the new major)pnpm audit --prod— no known vulnerabilities; no tar advisories in full auditNote:
pnpm test:initfails identically onmainin this environment (awk syntax error inscripts/canva-fse/convert-html-to-blocks.sh, a local mawk/gawk incompatibility) — unrelated to this change.🤖 Generated with Claude Code