Skip to content

Commit 3faf15b

Browse files
rhyslbwclaude
andcommitted
fix(release): bump @lerna-lite 2.x -> 4.x for tar 7 compatibility
The release `publish` job crashed: @lerna-lite/publish ... SyntaxError: The requested module 'tar' does not provide an export named 'default' @lerna-lite/publish@2.x does `import tar from 'tar'` (CJS default), but our security pin forces tar 7 (>=7.5.x — tar <7.5.x is vulnerable to GHSA-8qq5-... / -34x7-... arbitrary file overwrite & path traversal, introduced:0, no patched 6.x line). tar 7 is ESM-shaped with no default export -> crash. @lerna-lite 4.x uses `tar ^7.4.3` (imports tar 7 correctly) and needs Node >=22.9 (release runs Node 22). Bumping cli+publish to ^4.11.5 fixes the publish step while keeping the tar pin. Verified: `lerna publish --help` loads cleanly; build + immutable install green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 8c50d02 commit 3faf15b

2 files changed

Lines changed: 1089 additions & 1720 deletions

File tree

package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,8 @@
5858
"@atixlabs/eslint-config": "^1.2.3",
5959
"@commitlint/cli": "^13.1.0",
6060
"@commitlint/config-conventional": "^13.1.0",
61-
"@lerna-lite/cli": "^2.1.0",
62-
"@lerna-lite/publish": "^2.1.0",
61+
"@lerna-lite/cli": "^4.11.5",
62+
"@lerna-lite/publish": "^4.11.5",
6363
"@types/jest": "^26.0.24",
6464
"@types/node": "^22",
6565
"@typescript-eslint/eslint-plugin": "^5.27.1",

0 commit comments

Comments
 (0)