mcr.microsoft.com/cbl-mariner/base/nodejs:18 contains FedRAMP vulnerability on npm dependency - 'tar' v6.2.0

[EldarZ]

The latest version of mcr.microsoft.com/cbl-mariner/base/nodejs:18 contains Fedramp vulnerability in npm dependencies on package 'tar' version 6.2.0 (CVE-2024-28863)

'tar' fixed the vulnerability with their 6.2.1 release.

npm fixed the vulnerability here: https://github.com/npm/cli/commit/9ccff72c332e6062e6ebcf8123c7888d8d617091

npm released the fixes in npm version 10.8.1

mcr.microsoft.com/cbl-mariner/base/nodejs 18 latest NPM version is 10.5.0 (still contains this vulnerability):

docker run mcr.microsoft.com/cbl-mariner/base/nodejs:18 npm -v
10.5.0

Expected behavior: updated npm package with no Fedramp vulnerabilities.

[nisamson]

Addressing in PR #9372.

[jperrin]

This seems safe to close now as these have been patched.