fix(security): force serverless's tar to >=7.5.8 (CVE-2026-26960)

[sid88in]

fix(security): force serverless's tar to >=7.5.8 (Fixes #188)

Summary

Adds a scoped overrides entry that bumps the tar pulled in by the serverless devDependency from the vulnerable 6.2.1 to 7.5.19. This clears #188 and the other six tar < 7.5.8 alerts in one change.

// package.json → overrides
"serverless": {
  "tar": "^7.5.8"
}

The alert

Dependabot #188 — Arbitrary file read/write via hardlink target escape through a symlink chain in node-tar extraction (CVE-2026-26960 / GHSA-83g3-92jg-28cx, High 7.1). tar.extract() with default options lets an attacker-controlled archive create a hardlink inside the extraction directory that resolves to a file outside the extraction root, giving arbitrary read/write as the extracting user. Affected: tar < 7.5.8; patched: 7.5.8 (all 6.x are affected — the fix is only on the 7.x line).

The alert is tagged Development dependency and lists six sibling tar advisories; Dependabot notes that a single bump fixes 7 alerts total.

Why this is the right fix

The vulnerable copy is dev-only and comes from exactly one place:

devDependencies → serverless@3.40.0 → tar@6.2.1   (node_modules/tar)

• tar is not in the production dependency tree (npm ls tar --omit=dev → empty), so people who install the plugin were never exposed. The exposure is limited to this repo's own dev/CI environment.
• The fix line is 7.5.8+ only, so the patch requires moving serverless's tar from 6.x to 7.x. A scoped override (overrides.serverless.tar) does this without globally remapping every tar in the tree.

Result

• tar@6.2.1 is gone; serverless now resolves tar@7.5.19.
• npm run build, npm run lint (0 errors), and npm run test (362 passing) are all green. The unit tests load the Serverless framework, so they exercise serverless@3 + tar@7 compatibility — the major bump does not break it.

To apply

npm pkg set 'overrides.serverless.tar=^7.5.8'
npm install     # regenerates package-lock.json
npm run build && npm run lint && npm test
npm ls tar --all   # expect tar@7.5.19 under serverless; no 6.2.1

Notes / follow-ups

• Dev-only scope: the serverless + tar@7 combination is only used in this repo's dev/CI. The plugin's tests don't exercise serverless's archive-extraction path (serverless install), so if anyone relies on that locally a quick smoke test is worthwhile — blast radius is limited to the dev environment regardless.
• Separate, lower-severity residue: with tar@6.2.1 resolved, audit surfaces a distinct moderate advisory (GHSA-vmf3-w455-68vh, tar <= 7.5.15) on the tar@7.5.15 bundled inside the npm package (pulled by semantic-release). That's a different alert, not CreateFunction Permission #188, and because it's bundled inside npm the fix is to bump the npm / semantic-release devDependency line rather than a tar override. Tracked separately.

Summary by CodeRabbit

• Chores
  • Updated a nested dependency override to use a newer pinned version, helping keep the app’s package setup consistent and stable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 764b29a5-cbf0-4824-b6b2-bb5aa97d5094

📥 Commits

Reviewing files that changed from the base of the PR and between 6c31a16 and bd00c52.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

This change adds a nested override entry in package.json's overrides section, pinning the tar dependency used by the serverless package to version ^7.5.8.

Changes

Dependency Override Update

Layer / File(s)	Summary
Pin tar version for serverless override package.json	Adds a nested override specifying that the serverless package should use tar version ^7.5.8.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Related issues: None directly resolved by this change; linked issue #188 concerns missing IAM appsync:CreateFunction permission, which is unrelated to this dependency override.

Suggested labels: dependencies

Suggested reviewers: None

_{🐰 A tiny tweak in package.json's core,
pinning tar so serverless won't ignore,
version seven point five, tightly bound,
a small carrot patch, safe and sound.}

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR only pins serverless's tar dependency and does not address the AppSync CreateFunction permission issue.	Update the code or documentation to resolve the appsync:CreateFunction IAM permission problem described in #188, or retarget the PR.
Out of Scope Changes check	⚠️ Warning	The package.json tar override is unrelated to the linked AppSync permission requirement, so the change set is out of scope.	Align the PR with the linked issue or reopen it under the correct issue if the intended work is the tar security fix.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the security-related tar override for serverless.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bump-tar-cve-2026-26960

---

_{Comment @coderabbitai help to get the list of available commands.}