`HIGH` level security vulnerability in dependency chain: `node-tar`

[mcfoton]

TL:DR Bump the used version of unleash-client

---

CVE-2026-23745
The solution is to bump node-tar to at least 7.5.3
The dependency chain is @unleash/nextjs → unleash-client → make-fetch-happen → cacache
make-fetch-happen 15.0.3 uses cacache 20.0.1 (which dropped tar as a dependency).
Need to update @unleash/nextjs to get the newer make-fetch-happen, which is already used by unleash-client

upd: apologies for opening as bug, this is clearly not a bug 😌

[gastonfournier]

Hi @mcfoton thanks for reporting this! This comes as a transitive dependency from the node-sdk for which we already have an issue: Unleash/unleash-node-sdk#811

I'm going to be working on them and getting a new release out.