From d24d85a0c444b12016d25a06fd39398b48c7fb7d Mon Sep 17 00:00:00 2001 From: anupamme Date: Tue, 28 Jul 2026 06:28:04 +0000 Subject: [PATCH 1/3] fix: CVE-2026-59873 security vulnerability Automated dependency upgrade by OrbisAI Security --- package-lock.json | 7 ++++--- package.json | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 07ef97f47..67e7b20e4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -80,6 +80,7 @@ "motion": "^12.42.0", "mustache": "^4.2.0", "picomatch": "^4.0.4", + "tar": "^7.5.19", "url-parse": "^1.5.10", "vanilla-picker": "^2.12.3", "vscode-css-languageservice": "6.3.10", @@ -16121,9 +16122,9 @@ } }, "node_modules/tar": { - "version": "7.5.16", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz", - "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==", + "version": "7.5.19", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.19.tgz", + "integrity": "sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", diff --git a/package.json b/package.json index 34b717cce..27c74de0a 100644 --- a/package.json +++ b/package.json @@ -187,6 +187,7 @@ "motion": "^12.42.0", "mustache": "^4.2.0", "picomatch": "^4.0.4", + "tar": "^7.5.19", "url-parse": "^1.5.10", "vanilla-picker": "^2.12.3", "vscode-css-languageservice": "6.3.10", From 9208552ce99736ed5774a2f5cc7234f4f4be4269 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Tue, 28 Jul 2026 16:19:35 +0530 Subject: [PATCH 2/3] fix: move tar override from dependencies to overrides tar is a transitive dependency, not a direct one. Use the npm overrides field to pin the version, matching the existing pattern for @codemirror/* packages. Co-Authored-By: Claude Sonnet 4.6 --- package-lock.json | 1 - package.json | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 67e7b20e4..e1e561c57 100644 --- a/package-lock.json +++ b/package-lock.json @@ -80,7 +80,6 @@ "motion": "^12.42.0", "mustache": "^4.2.0", "picomatch": "^4.0.4", - "tar": "^7.5.19", "url-parse": "^1.5.10", "vanilla-picker": "^2.12.3", "vscode-css-languageservice": "6.3.10", diff --git a/package.json b/package.json index 27c74de0a..210c0529c 100644 --- a/package.json +++ b/package.json @@ -187,7 +187,6 @@ "motion": "^12.42.0", "mustache": "^4.2.0", "picomatch": "^4.0.4", - "tar": "^7.5.19", "url-parse": "^1.5.10", "vanilla-picker": "^2.12.3", "vscode-css-languageservice": "6.3.10", @@ -203,7 +202,8 @@ "@codemirror/lint": "^6.9.7", "@codemirror/search": "^6.7.1", "@codemirror/state": "^6.6.0", - "@codemirror/view": "^6.43.4" + "@codemirror/view": "^6.43.4", + "tar": "^7.5.19" }, "browserslist": "cover 100%", "allowScripts": { From e2da4e503bd4a303e10a02ed86a23440c798726e Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Tue, 28 Jul 2026 22:02:04 +0530 Subject: [PATCH 3/3] fix: update bun.lock to reflect tar override Regenerate bun.lock after moving tar from dependencies to overrides, ensuring the lock file is consistent with package.json. Co-Authored-By: Claude Opus 4.6 --- bun.lock | 26 +++++--------------------- 1 file changed, 5 insertions(+), 21 deletions(-) diff --git a/bun.lock b/bun.lock index 2e3f69e04..bbd334c56 100644 --- a/bun.lock +++ b/bun.lock @@ -111,6 +111,7 @@ "com.foxdebug.acode.rk.plugin.plugincontext": "file:src/plugins/pluginContext", "cordova-android": "^15.0.0", "cordova-clipboard": "^1.3.0", + "cordova-plugin-acode-webview": "file:src/plugins/webview", "cordova-plugin-advanced-http": "file:src/plugins/cordova-plugin-advanced-http", "cordova-plugin-browser": "file:src/plugins/browser", "cordova-plugin-buildinfo": "file:src/plugins/cordova-plugin-buildinfo", @@ -150,6 +151,7 @@ "@codemirror/search": "^6.7.1", "@codemirror/state": "^6.6.0", "@codemirror/view": "^6.43.4", + "tar": "^7.5.19", }, "packages": { "@antfu/install-pkg": ["@antfu/install-pkg@1.1.0", "", { "dependencies": { "package-manager-detector": "^1.3.0", "tinyexec": "^1.0.1" } }, "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ=="], @@ -1026,6 +1028,8 @@ "cordova-lib": ["cordova-lib@13.0.0", "", { "dependencies": { "cordova-common": "^6.0.0", "cordova-fetch": "^5.0.0", "detect-indent": "^6.1.0", "detect-newline": "^3.1.0", "execa": "^5.1.1", "globby": "^11.1.0", "semver": "^7.7.2", "stringify-package": "^1.0.1", "write-file-atomic": "^7.0.0" } }, "sha512-y8WQ+J6JtiU9C72ujvI3p+ScFJkg0VJwNfaUCqk9nPAssw2C6HltHk+ik/WrLUn6uDmwAM6gmfGUIMU2iVrNxA=="], + "cordova-plugin-acode-webview": ["cordova-plugin-acode-webview@file:src/plugins/webview", {}], + "cordova-plugin-advanced-http": ["cordova-plugin-advanced-http@file:src/plugins/cordova-plugin-advanced-http", { "devDependencies": { "chai": "4.3.6", "colors": "1.4.0", "cordova": "11.0.0", "mocha": "9.2.2", "umd-tough-cookie": "3.0.0", "wd": "1.14.0", "xml2js": "0.4.23" } }], "cordova-plugin-browser": ["cordova-plugin-browser@file:src/plugins/browser", {}], @@ -2070,7 +2074,7 @@ "tapable": ["tapable@2.3.0", "", {}, "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg=="], - "tar": ["tar@7.5.15", "", { "dependencies": { "@isaacs/fs-minipass": "^4.0.0", "chownr": "^3.0.0", "minipass": "^7.1.2", "minizlib": "^3.1.0", "yallist": "^5.0.0" } }, "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ=="], + "tar": ["tar@7.5.22", "", { "dependencies": { "@isaacs/fs-minipass": "^4.0.0", "chownr": "^3.0.0", "minipass": "^7.1.2", "minizlib": "^3.1.0", "yallist": "^5.0.0" } }, "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA=="], "tar-stream": ["tar-stream@2.2.0", "", { "dependencies": { "bl": "^4.0.3", "end-of-stream": "^1.4.1", "fs-constants": "^1.0.0", "inherits": "^2.0.3", "readable-stream": "^3.1.1" } }, "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ=="], @@ -2952,8 +2956,6 @@ "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/ssri": ["ssri@8.0.1", "", { "dependencies": { "minipass": "^3.1.1" } }, "sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ=="], - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/tar": ["tar@6.2.1", "", { "dependencies": { "chownr": "^2.0.0", "fs-minipass": "^2.0.0", "minipass": "^5.0.0", "minizlib": "^2.1.1", "mkdirp": "^1.0.3", "yallist": "^4.0.0" } }, "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A=="], - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/which/isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="], "cordova-plugin-advanced-http/cordova/cordova-create/npm-package-arg/hosted-git-info/lru-cache": ["lru-cache@6.0.0", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA=="], @@ -2986,8 +2988,6 @@ "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/ssri": ["ssri@8.0.1", "", { "dependencies": { "minipass": "^3.1.1" } }, "sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ=="], - "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/tar": ["tar@6.2.1", "", { "dependencies": { "chownr": "^2.0.0", "fs-minipass": "^2.0.0", "minipass": "^5.0.0", "minizlib": "^2.1.1", "mkdirp": "^1.0.3", "yallist": "^4.0.0" } }, "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A=="], - "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/which/isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="], "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/@npmcli/git/lru-cache": ["lru-cache@6.0.0", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA=="], @@ -3024,12 +3024,6 @@ "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/npm-registry-fetch/minizlib": ["minizlib@2.1.2", "", { "dependencies": { "minipass": "^3.0.0", "yallist": "^4.0.0" } }, "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg=="], - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/tar/minipass": ["minipass@5.0.0", "", {}, "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ=="], - - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/tar/minizlib": ["minizlib@2.1.2", "", { "dependencies": { "minipass": "^3.0.0", "yallist": "^4.0.0" } }, "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg=="], - - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/tar/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], - "cordova-plugin-advanced-http/cordova/cordova-create/npm-package-arg/hosted-git-info/lru-cache/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/npm-package-arg/hosted-git-info/lru-cache": ["lru-cache@6.0.0", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA=="], @@ -3068,12 +3062,6 @@ "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/npm-registry-fetch/minizlib": ["minizlib@2.1.2", "", { "dependencies": { "minipass": "^3.0.0", "yallist": "^4.0.0" } }, "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg=="], - "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/tar/minipass": ["minipass@5.0.0", "", {}, "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ=="], - - "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/tar/minizlib": ["minizlib@2.1.2", "", { "dependencies": { "minipass": "^3.0.0", "yallist": "^4.0.0" } }, "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg=="], - - "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/tar/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/@npmcli/git/lru-cache/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/@npmcli/run-script/node-gyp/glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="], @@ -3096,8 +3084,6 @@ "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/npm-registry-fetch/minizlib/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/tar/minizlib/minipass": ["minipass@3.3.6", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw=="], - "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/npm-package-arg/hosted-git-info/lru-cache/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/@npmcli/git/lru-cache/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], @@ -3122,8 +3108,6 @@ "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/npm-registry-fetch/minizlib/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], - "cordova-plugin-advanced-http/cordova/cordova-lib/cordova-fetch/pacote/tar/minizlib/minipass": ["minipass@3.3.6", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw=="], - "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/@npmcli/run-script/node-gyp/glob/minimatch": ["minimatch@3.1.2", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw=="], "cordova-plugin-advanced-http/cordova/cordova-create/cordova-fetch/pacote/@npmcli/run-script/node-gyp/request/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],