[Request] Upgrade tar to v6.2.1

[anhcao142]

Hi currently, our yarn npm audit alerts that tar versions < 6.2.1 are vulnerable. This is our log

└─ tar
   ├─ ID: 1096915
   ├─ Issue: Denial of service while parsing a tar file due to lack of folders count validation
   ├─ URL: https://github.com/advisories/GHSA-f5x3-32g6-xq36
   ├─ Severity: moderate
   ├─ Vulnerable Versions: <6.2.1
   │
   ├─ Tree Versions
   │  └─ 6.2.0
   │
   └─ Dependents
      └─ @mapbox/node-pre-gyp@npm:1.0.11

[cclauss]

https://www.npmjs.com/package/tar

node-gyp/package.json

Line 33 in 77737e4

"tar": "^6.1.2",

@anhcao142 Are you able to make a pull request to update this dependency?

[lukekarrys]

@anhcao142 The log you posted indicates that @mapbox/node-pre-gyp is the dependency responsible for the vulnerable version of tar.

[anhcao142]

Yeah I just noticed that, will close this now

[mvanzoest]

Hi, just as a heads up, it looks like tar is a direct dependency of node-gyp:

[cclauss]

Yes. As stated above at #3013 (comment)

@anhcao142 Are you able to make a pull request to update this dependency?

[mvanzoest]

Yes. As stated above at #3013 (comment)

@anhcao142 Are you able to make a pull request to update this dependency?

#3021