Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: isaacs/node-tar
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v7.5.6
Choose a base ref
...
head repository: isaacs/node-tar
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v7.5.7
Choose a head ref
  • 2 commits
  • 4 files changed
  • 1 contributor

Commits on Jan 27, 2026

  1. fix: properly sanitize hard links containing .. 

    Fix: GHSA-34x7-hfp2-rc4v

The issue here is that *hard* links are resolved relative to the unpack
cwd, so if they have `..`, they cannot possibly be valid, same as files
and for the same reason. The loosening of this restriction for symbolic
links should have been limited by type, allowing this error.
    @isaacs
    isaacs committed Jan 27, 2026
    Configuration menu
    Copy the full SHA
    f4a7aa9 View commit details
    Browse the repository at this point in the history

  2. 7.5.7

    @isaacs
    isaacs committed Jan 27, 2026
    Configuration menu
    Copy the full SHA
    4a37eb9 View commit details
    Browse the repository at this point in the history
Loading