testcontainers depends on vulnerable versions of tar-fs

[juliette-derancourt]

Dependabot brought to my attention that tar-fs introduces security vulnerabilities for versions prior to 3.0.9, 2.1.3, and 1.16.5 (CVE).

According to npm why tar-fs, testcontainers@11.5.1 transitively depends on versions 3.0.6 and 2.0.1.

Could this dependency be upgraded?

[cristianrgreco]

Hi @juliette-derancourt, I only just released the latest Dependabot PR #1102. Running npm audit shows 0 vulnerabilities

[juliette-derancourt]

Ok, thanks for the reply
That's weird, this is what dependabot is telling me, saying that it should be upgraded to 2.1.3 🤔

[ivan-auror]

dockerode depends on tar-fs 2.1.2 which is within the vulnerable range.
There is an open issue (2 months old at the time of this comment): apocas/dockerode#812

[cristianrgreco]

@ivan-auror I believe this is a dockerode specific issue. Running npm audit in this repo doesn't return any issues. Running npm ls in this repo you can see we use tar-fs@3.1.0.