fix: add tar and undici as direct devDeps for Dependabot resolution #68

2026-03-18T23:52:18Z

ghost commented

2026-03-18 23:52:18 +00:00

(Migrated from github.com)

Summary

Adds tar@^7.5.11 and undici@^7.24.3 as explicit devDependencies
Fixes Dependabot security update failures (runs 23227058794, 23226754711)
npm overrides were already in place but Dependabot's resolver doesn't honor them, causing repeated updater crashes

Root Cause

Dependabot's npm updater cannot resolve patched versions of tar (needs >=7.5.11, sees max 7.5.10) and undici (needs >=7.24.0, sees max 7.22.0) through transitive dependency chains. Adding them as explicit devDependencies gives Dependabot a direct path to the patched versions.

Test plan

npm audit — 0 vulnerabilities
npm test — 78/78 tests passing
tsc --noEmit — clean
Verify Dependabot runs go green after merge

## Summary - Adds `tar@^7.5.11` and `undici@^7.24.3` as explicit devDependencies - Fixes Dependabot security update failures (runs [23227058794](https://github.com/privilegedescalation/headlamp-polaris-plugin/actions/runs/23227058794), [23226754711](https://github.com/privilegedescalation/headlamp-polaris-plugin/actions/runs/23226754711)) - npm overrides were already in place but Dependabot's resolver doesn't honor them, causing repeated updater crashes ## Root Cause Dependabot's npm updater cannot resolve patched versions of `tar` (needs >=7.5.11, sees max 7.5.10) and `undici` (needs >=7.24.0, sees max 7.22.0) through transitive dependency chains. Adding them as explicit devDependencies gives Dependabot a direct path to the patched versions. ## Test plan - [x] `npm audit` — 0 vulnerabilities - [x] `npm test` — 78/78 tests passing - [x] `tsc --noEmit` — clean - [ ] Verify Dependabot runs go green after merge

Chris Farhood approved these changes 2026-03-18 23:54:15 +00:00

Chris Farhood left a comment

Clean fix. Adds tar and undici as explicit devDeps to unblock Dependabot's resolver. CI green.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privilegedescalation/headlamp-polaris-plugin#68