fix(agentex-ui): bump tar 7.5.11 -> 7.5.16 (CVE-2026-53655)

[scale-prodsec]

Summary

Remediates CVE-2026-53655 (MEDIUM) — node-tar file smuggling due to inconsistent tar archive parsing (GHSA-vmf3-w455-68vh).

tar is a transitive dependency of agentex-ui/, present in the built image (golden/agentex-ui) at app/node_modules/tar version 7.5.11 (< the fixed 7.5.16). It is pulled in by @tailwindcss/oxide@4.1.11 (declares tar: ^7.4.3) and already force-pinned via the repo's overrides block.

Change

• agentex-ui/package.json: raise the existing overrides pin tar: "^7.5.11" → "^7.5.16" (same mechanism already used for cross-spawn and tar).
• agentex-ui/package-lock.json: regenerated with npm install --package-lock-only. npm resolves the single hoisted node_modules/tar to 7.5.20 (latest 7.5.x satisfying ^7.5.16, ≥ fixed 7.5.16). The old 7.5.11 is gone. Net lockfile change is the one tar entry only (4 insertions / 4 deletions); tar's own dependency set is unchanged between 7.5.11 and 7.5.20, so there is zero transitive churn.

Safety

Patch bump within major 7 (7.5.11 → 7.5.20) and within the consumer's declared ^7.4.3 range — no major boundary crossed, so @tailwindcss/oxide remains fully compatible. tar is only used by the tailwind build tool (transitive), not imported by application source.

Verification

• npm ci --dry-run resolves cleanly (718 packages, no lockfile-sync error) — matches the Dockerfile build gate (npm ci).
• No remaining tar 7.5.11 (or any tar < 7.5.16) anywhere in the lockfile.

Resolves GFDVR-17704 (child GFDVR-17708 — tar@7.5.11 / CVE-2026-53655).

Greptile Summary

Bumps the tar transitive dependency from 7.5.11 to 7.5.20 (resolved by npm from the new ^7.5.16 override) in agentex-ui/ to close CVE-2026-53655 (CWE-436 tar-parser interpretation differential / file smuggling). The tar package is used only by @tailwindcss/oxide at build time, not by application code.

• package.json: raises the existing overrides.tar pin from \"^7.5.11\" → \"^7.5.16\", using the same override mechanism already in place for cross-spawn.
• package-lock.json: single hoisted tar entry updated from 7.5.11 to 7.5.20; no transitive dependency changes because tar's own dependency set is identical between these two patch versions.

Confidence Score: 5/5

Safe to merge — this is a targeted patch-version bump of a build-time-only transitive dependency with no application code changes.

The change is confined to two files: the overrides pin in package.json and the regenerated lockfile entry. The resolved version (7.5.20) is within the range required by the consuming package (@tailwindcss/oxide declares ^7.4.3), the fix lands well above the minimum required by the new pin (^7.5.16), and tar is never imported by application source — it is used exclusively by the Tailwind build toolchain. No transitive dependency churn was introduced.

No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Raises the existing overrides.tar pin from ^7.5.11 to ^7.5.16 to remediate CVE-2026-53655; no other changes.
agentex-ui/package-lock.json	Lockfile regenerated: single hoisted node_modules/tar entry updated from 7.5.11 to 7.5.20 (satisfies ^7.5.16); no transitive dependency churn.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["@tailwindcss/oxide@4.1.11\n(declares tar: ^7.4.3)"] -->|"resolved by npm overrides"| B["tar@7.5.20\n(was 7.5.11)"]
    B --> C["✅ >= 7.5.16\n(CVE-2026-53655 fixed)"]
    D["package.json overrides\ntar: ^7.5.16"] -->|"forces npm resolution"| B
    E["Application source\nagentex-ui/**"] -.->|"does NOT import tar"| F["(build-time only)"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["@tailwindcss/oxide@4.1.11\n(declares tar: ^7.4.3)"] -->|"resolved by npm overrides"| B["tar@7.5.20\n(was 7.5.11)"]
    B --> C["✅ >= 7.5.16\n(CVE-2026-53655 fixed)"]
    D["package.json overrides\ntar: ^7.5.16"] -->|"forces npm resolution"| B
    E["Application source\nagentex-ui/**"] -.->|"does NOT import tar"| F["(build-time only)"]

Loading

_{Reviews (1): Last reviewed commit: "fix(agentex-ui): bump tar 7.5.11 -> 7.5...." | Re-trigger Greptile}