GeezerVison

Problem

• npm-distribution/package.json includes old unneeded, and should be tidied

• Renovate also opens unnecessary PRs to update them

  • Update dependency cross-spawn to ^7.0.6 #1389
  • Update dependency brace-expansion to ^2.1.7 #1390
  • Update dependency @types/tar to v7 #1391
  • Update dependency brace-expansion to v5 #1392
  • Update dependency glob to v14 #1393

Solution

• Remove the overrides block

  • It was added in fix: upgrade glob to 10.5.0 (CVE-2025-64756) #1218 and fix: upgrade cross-spawn to 7.0.6 (CVE-2024-21538) #1219 to force patching cross-spawn, glob, and brace-expansion, which tar 7.1 pulled in through rimraf
  • tar 7.5 (chore/security: update deps for CVEs reported by trivy #1319, chore/deps: bump vulnerable dependencies ahead of 7.6.0 release #1357) dropped rimraf, so none of those packages are in the lockfile anymore and the overrides are no longer effective

• Remove @types/tar

  • npm-distribution/ has no TypeScript (three .js files), and tar 7 ships its own types

• Regenerated package-lock.json via npm install --package-lock-only

• Once merged, Renovate should close the five PRs above on its own since the packages are no longer declared

Test plan

• Verified locally: npm ci from the new lockfile, npm audit reports 0 vulnerabilities, require("tar") loads

Amp thread

https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8