CVE-2024-28863 - Lerna using a vulnerable version of tar

[jimblanc]

Current Behavior

Good day,
We received a dependabot alert on our repo due to Lerna's use of tar in @lerna/create & @lerna/legacy-package-management relating to CVE-2024-28863. Would it be possible to update tar to v6.2.1 in Lerna v7 & v8?

Expected Behavior

Lerna should not use the impacted versions of tar.

Steps to Reproduce

npm audit in a project that is using Lerna.

This issue may not be prioritized if details are not provided to help us reproduce the issue.

Failure Logs / Configuration

N/A

Environment

N/A

[alexsaker]

There is an automatic PR dealing with this issue.
An "Exceeded timeout of 60000 ms for a hook." was thrown by the CI here.
Not sure whether it is just a glitch with CI agents or if the tar package update broke something.

[sergeyklay]

@JamesHenry Could you please take a look