archetech / archon / 29774570486

90%

main: 90%

Pull #754

github

security: bump form-data and tar overrides in mediators

form-data and tar are transitive deps in the blockchain mediators, already
pinned via the overrides block. Bump the pins to patched versions:

- form-data 2.5.5 -> 2.5.6 (solana, ethereum, zcash, satoshi-wallet)
  fixes GHSA-hmw2-7cc7-3qxx (CRLF injection via unescaped multipart field
  names/filenames). satoshi-wallet pins it under the `request` override.
- tar ^7.5.1 -> ^7.5.16 (solana, ethereum, zcash; resolves 7.5.16)
  clears the node-tar path-traversal / symlink / hardlink advisory cluster
  (GHSA-34x7, 83g3, 9ppj, 8qq5, r6q2, qffp) and GHSA-vmf3 (PAX size override).

Lockfiles regenerated via npm install --package-lock-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2979 of 3529 branches covered (84.41%)

Branch coverage included in aggregate %.

6173 of 6599 relevant lines covered (93.54%)

835.78 hits per line