From 394bbd47d988d3ad31a9f842c6317caa8c924224 Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:38:47 +0000
Subject: [PATCH 1/2] chore: upgrade tar to ^7.5.20 to address CVE-2026-59875

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1555/sourcebot-devsourcebot-cve-2026-59875-node-tar-node-tar-denial-of#agent-session-cf7a0688)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 +++
 yarn.lock    | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce01f93fa..d39ee784a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Upgraded `tar` to `^7.5.20`. [#1466](https://github.com/sourcebot-dev/sourcebot/pull/1466)
+
 ## [5.1.3] - 2026-07-20
 
 ### Added
diff --git a/yarn.lock b/yarn.lock
index 54653dc8d..051755b31 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -22857,15 +22857,15 @@ __metadata:
   linkType: hard
 
 "tar@npm:^7.4.3":
-  version: 7.5.16
-  resolution: "tar@npm:7.5.16"
+  version: 7.5.20
+  resolution: "tar@npm:7.5.20"
   dependencies:
     "@isaacs/fs-minipass": "npm:^4.0.0"
     chownr: "npm:^3.0.0"
     minipass: "npm:^7.1.2"
     minizlib: "npm:^3.1.0"
     yallist: "npm:^5.0.0"
-  checksum: 10c0/4f37f3c4bd2ca2755fd736a5df1d573c1a868ec1b1e893346aeafa95ac510f9e2fd1469420bd866cc7904799e5bd4ac62b5d4f03fe27747d6e1e373b44505c5c
+  checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
   languageName: node
   linkType: hard
 

From 48b1afbed75db8ac86e1bdf9e1118f96ed6261b6 Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:39:11 +0000
Subject: [PATCH 2/2] chore: fix CHANGELOG PR link

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1555/sourcebot-devsourcebot-cve-2026-59875-node-tar-node-tar-denial-of#agent-session-cf7a0688)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d39ee784a..a7858c601 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
-- Upgraded `tar` to `^7.5.20`. [#1466](https://github.com/sourcebot-dev/sourcebot/pull/1466)
+- Upgraded `tar` to `^7.5.20`. [#1474](https://github.com/sourcebot-dev/sourcebot/pull/1474)
 
 ## [5.1.3] - 2026-07-20