Distillation

Date: Aug 7, 2026

• 🟡 (15:24) tar-fs version lookup result: installed/flagged version is 1.16.3. Tool listed tar-fs@2.1.4 and tar-fs@2.1.5 under header "---latest 1.x---", and tar-fs@3.1.3 under "---latest---".
• 🟡 (15:24) @vercel/client declares an exact-pinned dependency: 'tar-fs': '1.16.3' (exact pin, no range) — so a plain lockfile refresh will not move it off the vulnerable 1.16.3; fix likely requires an override (pnpm.overrides) or an updated @vercel/client.