Commit 3faf15b
fix(release): bump @lerna-lite 2.x -> 4.x for tar 7 compatibility
The release `publish` job crashed:
@lerna-lite/publish ... SyntaxError: The requested module 'tar' does not
provide an export named 'default'
@lerna-lite/publish@2.x does `import tar from 'tar'` (CJS default), but our
security pin forces tar 7 (>=7.5.x — tar <7.5.x is vulnerable to GHSA-8qq5-...
/ -34x7-... arbitrary file overwrite & path traversal, introduced:0, no
patched 6.x line). tar 7 is ESM-shaped with no default export -> crash.
@lerna-lite 4.x uses `tar ^7.4.3` (imports tar 7 correctly) and needs Node
>=22.9 (release runs Node 22). Bumping cli+publish to ^4.11.5 fixes the
publish step while keeping the tar pin. Verified: `lerna publish --help`
loads cleanly; build + immutable install green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>1 parent 8c50d02 commit 3faf15b
2 files changed
Lines changed: 1089 additions & 1720 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
58 | 58 | | |
59 | 59 | | |
60 | 60 | | |
61 | | - | |
62 | | - | |
| 61 | + | |
| 62 | + | |
63 | 63 | | |
64 | 64 | | |
65 | 65 | | |
| |||
0 commit comments