Security: Update tar-fs to fix path traversal vulnerability (CVE-2024-12905)

[jmaddington]

Description

The tar-fs package has a high severity path traversal vulnerability (CVE-2024-12905) that could result in unauthorized file writes or overwrites outside the intended extraction directory.

Details

• This vulnerability affects the project through transitive dependencies
• Dependabot has flagged this as alert Fix: XSS vulnerability with exception text (CodeQL #7) #29 and Fix: Code injection vulnerability (CodeQL #5) #30
• The vulnerability is present in tar-fs versions < 2.1.2 (for version 2.x series)
• Current dependency tree contains vulnerable versions

Proposed Solution

Add an override/resolution for tar-fs to ensure version 2.1.2 or higher is used throughout the dependency tree:

References

• CVE-2024-12905
• GHSA-pq67-2wwv-3xjx
• GHSA-pq67-2wwv-3xjx