javascriptarchiverjs/node-archiver #446Not a task: already works

NPM Advisory - BL - Remote Memory Exposure

envgap__archiverjs__node-archiver-446

Original GitHub issue ↗Dated source checkout ↗Opened 2020-09-08

01 / FAILURE SIGNATURE

As reported upstream

No identifying execution failure has been captured.

Not a benchmark task.

The project already builds and runs before the fix, so there is nothing to repair.

02 / ENVIRONMENT RECIPE

Base commit: cef1ac966e231834d6c1f083ee50698b133d17cb
Manifest: package.json
Reproduce: Awaiting issue-specific recipe
Run under trace: Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

archiverjs/node-archiver #446 · read the original issue

The version of `bl` that is included in `tar-stream` is affected by https://npmjs.com/advisories/1555. `bl` has released 4.0.3 which fixes this. An update request has been asked of `tar-stream` here: https://github.com/mafintosh/tar-stream/issues/126



Once that request has been fulfilled and an update released, an update of `tar-stream` here would be appreciated to resolve this security vulnerability.

Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched

[]