tar - npm Package Compare versions

Comparing version 7.5.5 to 7.5.6

dist/commonjs/pack.d.ts

@@ -41,2 +41,3 @@ import { type Stats } from 'fs';
 export declare class Pack extends Minipass<Buffer, ReadEntry | string, WarnEvent<Buffer>> implements Warner {
+    sync: boolean;
     opt: TarOptions;
@@ -43,0 +44,0 @@ cwd: string;

dist/commonjs/pack.js

@@ -94,2 +94,3 @@ "use strict";
 class Pack extends minipass_1.Minipass {
+    sync = false;
     opt;
@@ -283,2 +284,13 @@ cwd;
         }
+        else if (stat.isFile() &&
+            stat.nlink > 1 &&
+            job === this[CURRENT] &&
+            !this.linkCache.get(`${stat.dev}:${stat.ino}`) &&
+            !this.sync) {
+            // if it's not filtered, and it's a new File entry,
+            // jump the queue in case any pending Link entries are about
+            // to try to link to it. This prevents a hardlink from coming ahead
+            // of its target in the archive.
+            this[PROCESSJOB](job);
+        }
         this[PROCESS]();
@@ -285,0 +297,0 @@ }

dist/esm/pack.d.ts

@@ -41,2 +41,3 @@ import { type Stats } from 'fs';
 export declare class Pack extends Minipass<Buffer, ReadEntry | string, WarnEvent<Buffer>> implements Warner {
+    sync: boolean;
     opt: TarOptions;
@@ -43,0 +44,0 @@ cwd: string;

dist/esm/pack.js

@@ -54,2 +54,3 @@ // A readable tar stream creator
 export class Pack extends Minipass {
+    sync = false;
     opt;
@@ -243,2 +244,13 @@ cwd;
         }
+        else if (stat.isFile() &&
+            stat.nlink > 1 &&
+            job === this[CURRENT] &&
+            !this.linkCache.get(`${stat.dev}:${stat.ino}`) &&
+            !this.sync) {
+            // if it's not filtered, and it's a new File entry,
+            // jump the queue in case any pending Link entries are about
+            // to try to link to it. This prevents a hardlink from coming ahead
+            // of its target in the archive.
+            this[PROCESSJOB](job);
+        }
         this[PROCESS]();
@@ -245,0 +257,0 @@ }

package.json

@@ -5,3 +5,3 @@ {
   "description": "tar for node",
-  "version": "7.5.5",
+  "version": "7.5.6",
   "repository": {
@@ -8,0 +8,0 @@ "type": "git",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1255971

0.22%

Lines of code

11916

0.22%

Worsened metrics

Number of low supply chain risk alerts

52

4%

No dependency changes