bump: tar to 7.5.22, ignore react-router advisories cp-13.41.0

[HowardBraham]

Description

• tar to 7.5.22
• Ignoring three react-router advisories because they don't apply to how we're using them, and updating would require a very difficult major version bump

Changelog

CHANGELOG entry: null

Related issues

Closes: #44805
Progresses: #44859

---

Note

Low Risk
Mostly lockfile and LavaMoat policy alignment plus documented audit suppressions; tar/stream changes affect Snaps packaging but are routine security bumps.

Overview
Dependency refresh for the Snaps/tar extraction stack: tar moves to 7.5.22, with related bumps (tar-stream 3.2.0, streamx 2.28.0, tar-fs 2.1.5, and new transitive packages such as events-universal, text-decoder, and optional bare-* peers). queue-tick drops out of the streamx graph in favor of that newer layout.

LavaMoat webpack policies (MV2/MV3 variants) are regenerated to match: streamx now allows process.nextTick / queueMicrotask, wires events-universal and text-decoder instead of queue-tick, and drops the standalone queue-tick entry.

Yarn audit adds three ignored React Router GHSA IDs with rationale—HashRouter (not server-controlled browser paths) for the open-redirect issues and no SSR/hydration for the deserializeErrors advisory—so CI stays green without a major React Router upgrade.

^{Reviewed by Cursor Bugbot for commit e846388. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[HowardBraham]

@metamaskbot update-policies

[metamask-ci]

Policies updated.
👀 Please review the diff for suspicious new powers.

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.
🧠 Learn how to read policy diffs: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/webpack/mv2/beta/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv3/beta/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/experimental/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes
👀 lavamoat/webpack/mv3/flask/policy.json changes differ from lavamoat/webpack/mv3/main/policy.json changes

[metamask-ci]

✨ Files requiring CODEOWNER review ✨

📜 @MetaMask/policy-reviewers (8 files, +128 -56)

• 📁 lavamoat/
  • 📁 webpack/
    • 📁 mv2/
      • 📁 beta/
        • 📄 policy.json +16 -7
      • 📁 experimental/
        • 📄 policy.json +16 -7
      • 📁 flask/
        • 📄 policy.json +16 -7
      • 📁 main/
        • 📄 policy.json +16 -7
    • 📁 mv3/
      • 📁 beta/
        • 📄 policy.json +16 -7
      • 📁 experimental/
        • 📄 policy.json +16 -7
      • 📁 flask/
        • 📄 policy.json +16 -7
      • 📁 main/
        • 📄 policy.json +16 -7

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[metamask-ci]

Builds ready [e846388]

• ⚠️ Make sure the build is safe before downloading and running this build.
  • Please do not use these builds with accounts that contain significant real money.
  • Beware the security risks of cache poisoning.
• Webpack builds: chrome, firefox
• Webpack builds (beta): chrome, firefox
• Webpack builds (flask): chrome, firefox
• Webpack builds (test): chrome, firefox
• Webpack builds (test-flask): chrome, firefox
• bundle size: Bundle Size Stats
• bundle analyzer: Bundle Analyzer
• interaction-benchmark: Interaction Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts

⚡ Performance Benchmarks (Total: 🟢 14 pass · 🟡 9 warn · 🔴 1 fail)

Baseline (latest main): b6619a9 | Date: 7/24/2026 | Pipeline: 30118526884 | Baseline logs

Metrics	chrome-webpack	firefox-webpack
onboardingImportWallet [Sentry log · main/release]	🔴 [CI log]	🟢 [CI log]

Regressions (🔴 1 failure)

• onboardingImportWallet [Sentry log · main/release] · chrome-webpack — total(p75) [CI log]

Interaction Benchmarks · Samples: 5

Benchmark	chrome-webpack	firefox-webpack
loadNewAccount [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
confirmTx [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
bridgeUserActions [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ bridgeUserActions/bridge_load_page: -12%
• ↑ bridgeUserActions/bridge_load_asset_picker: +17%
• ↑ bridgeUserActions/longTaskCount: +25%
• ↑ bridgeUserActions/longTaskTotalDuration: +26%
• ↑ bridgeUserActions/tbt: +26%
• ↓ loadNewAccount/inp: -28%
• ↑ loadNewAccount/lcp: +1145%
• ↓ confirmTx/longTaskCount: -100%
• ↓ confirmTx/longTaskTotalDuration: -100%
• ↓ confirmTx/longTaskMaxDuration: -100%
• ↓ confirmTx/tbt: -100%
• ↓ confirmTx/inp: -36%
• ↓ confirmTx/fcp: -48%
• ↑ confirmTx/lcp: +1141%
• ↑ bridgeUserActions/bridge_load_page: +127%
• ↑ bridgeUserActions/bridge_load_asset_picker: +45%
• ↓ bridgeUserActions/longTaskCount: -100%
• ↓ bridgeUserActions/longTaskTotalDuration: -100%
• ↓ bridgeUserActions/longTaskMaxDuration: -100%
• ↓ bridgeUserActions/tbt: -100%
• ↑ bridgeUserActions/total: +18%
• ↓ bridgeUserActions/inp: -29%
• ↑ bridgeUserActions/lcp: +1132%

Startup Benchmarks · Samples: 100

Benchmark	chrome-webpack	firefox-webpack
startupStandardHome [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log] 🟡 loadScripts
startupPowerUserHome [Sentry log · main/release]	–	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ startupStandardHome/lcp: -32%
• ↑ startupStandardHome/load: +11%
• ↑ startupStandardHome/domContentLoaded: +10%
• ↑ startupStandardHome/domInteractive: +89%
• ↑ startupStandardHome/backgroundConnect: +12%
• ↑ startupStandardHome/initialActions: +11%
• ↑ startupStandardHome/loadScripts: +11%
• ↑ startupStandardHome/setupStore: +11%
• ↑ startupStandardHome/fcp: +84%
• ↓ startupPowerUserHome/uiStartup: -24%
• ↓ startupPowerUserHome/load: -22%
• ↓ startupPowerUserHome/domContentLoaded: -22%
• ↓ startupPowerUserHome/domInteractive: -17%
• ↓ startupPowerUserHome/backgroundConnect: -31%
• ↓ startupPowerUserHome/firstReactRender: -18%
• ↓ startupPowerUserHome/loadScripts: -21%
• ↓ startupPowerUserHome/setupStore: -77%
• ↓ startupPowerUserHome/inp: -20%
• ↓ startupPowerUserHome/fcp: -14%
• ↓ startupPowerUserHome/lcp: -24%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 startupPowerUserHome/LCP: p75 2.5s

User Journey Benchmarks · Samples: 5 · mock API 🔴 1

Benchmark	chrome-webpack	firefox-webpack
onboardingImportWallet [Sentry log · main/release]	🔴 [CI log] 🔴 total	🟢 [CI log]
onboardingNewWallet [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log] 🟡 total
assetDetails [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
solanaAssetDetails [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
importSrpHome [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]
sendTransactions [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
swap [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ onboardingImportWallet/metricsToWalletReadyScreen: -27%
• ↓ onboardingImportWallet/doneButtonToHomeScreen: -93%
• ↓ onboardingImportWallet/longTaskCount: -89%
• ↓ onboardingImportWallet/longTaskTotalDuration: -96%
• ↓ onboardingImportWallet/longTaskMaxDuration: -93%
• ↓ onboardingImportWallet/tbt: -100%
• ↓ onboardingImportWallet/total: -78%
• ↓ onboardingNewWallet/doneButtonToAssetList: -80%
• ↓ onboardingNewWallet/longTaskCount: -64%
• ↓ onboardingNewWallet/longTaskTotalDuration: -77%
• ↓ onboardingNewWallet/longTaskMaxDuration: -46%
• ↓ onboardingNewWallet/tbt: -96%
• ↓ onboardingNewWallet/total: -77%
• ↓ solanaAssetDetails/assetClickToPriceChart: -71%
• ↓ solanaAssetDetails/longTaskCount: -100%
• ↓ solanaAssetDetails/longTaskTotalDuration: -100%
• ↓ solanaAssetDetails/longTaskMaxDuration: -100%
• ↓ solanaAssetDetails/total: -71%
• ↓ importSrpHome/loginToHomeScreen: -26%
• ↓ importSrpHome/homeAfterImportWithNewWallet: -36%
• ↓ importSrpHome/longTaskCount: -53%
• ↓ importSrpHome/longTaskTotalDuration: -48%
• ↓ importSrpHome/tbt: -44%
• ↓ importSrpHome/total: -34%
• ↓ importSrpHome/inp: -19%
• ↑ importSrpHome/lcp: +22%
• ↑ importSrpHome/cls: +613%
• ↓ sendTransactions/openSendPageFromHome: -17%
• ↓ sendTransactions/selectTokenToSendFormLoaded: -31%
• ↓ sendTransactions/reviewTransactionToConfirmationPage: -97%
• ↓ sendTransactions/longTaskCount: -100%
• ↓ sendTransactions/longTaskTotalDuration: -100%
• ↓ sendTransactions/longTaskMaxDuration: -100%
• ↓ sendTransactions/tbt: -100%
• ↓ sendTransactions/total: -95%
• ↓ sendTransactions/inp: -30%
• ↑ sendTransactions/cls: +239%
• ↑ swap/fetchAndDisplaySwapQuotes: +151%
• ↓ swap/longTaskCount: -17%
• ↓ swap/longTaskTotalDuration: -28%
• ↓ swap/longTaskMaxDuration: -16%
• ↓ swap/tbt: -69%
• ↑ swap/total: +149%
• ↑ swap/inp: +17%
• ↓ swap/cls: -88%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 importSrpHome/INP: p75 272ms
• 🟡 assetDetails/FCP: p75 1.8s
• 🟡 solanaAssetDetails/FCP: p75 1.9s
• 🟡 importSrpHome/FCP: p75 1.9s
• 🟡 sendTransactions/FCP: p75 1.8s
• 🟡 swap/FCP: p75 1.9s

Dapp Page Load Benchmarks · Samples: 100

Benchmark	chrome-webpack
dappPageLoad [Sentry log · main/release]	🟢 [CI log]

Bundle size diffs [🚨 Warning! Bundle size has increased!]

• background: 8.92 KiB (0.06%)
• ui: 384 Bytes (0%)
• common: 0 Bytes (0%)
• other: 0 Bytes (0%)
• contentScripts: 678 Bytes (0.03%)
• zip: 2.41 KiB (0.01%)

[gauthierpetetin]

Missing release label release-13.42.0 on PR. Adding release label release-13.42.0 on PR and removing other release labels(release-13.43.0), as PR was cherry-picked in branch 13.42.0.

[gauthierpetetin]

Missing release label release-13.41.0 on PR. Adding release label release-13.41.0 on PR and removing other release labels(release-13.43.0), as PR was cherry-picked in branch 13.41.0.

[gauthierpetetin]

More than one release label on PR. Keeping the lowest one (release-13.41.0) on PR and removing other release labels (release-13.42.0).

[gauthierpetetin]

More than one release label on PR. Keeping the lowest one (release-13.41.0) on PR and removing other release labels (release-13.42.0).

[MajorLift]

🧪 Validation Run

Verdict: 📋 measured, no verdict asserted — Claim: a tar bump plus three React Router advisories suppressed on the grounds that the extension's routing model does not reach them. head c08a8bb748f · 2026-08-02 · dependency-containment check

Note

Trial run of the MetaMask evidence skills,
using the supply-chain skill —
feedback welcome, on the finding or on whether this format is useful to a reviewer.
Not a review verdict; nothing here blocks the PR.

What the change touches, measured in CI at the merge commit:

Ran to completion (exit 0) — read the output, no verdict asserted

Claim under test: which packages move, and what the advisory-ignore list gains

$ sh -c git diff --stat c08a8bb748f28dccb96879baec496aa279071421^ c08a8bb748f28dccb96879baec496aa279071421; echo; echo == manifest ==; git diff c08a8bb748f28dccb96879baec496aa279071421^ c08a8bb748f28dccb96879baec496aa279071421 -- package.json
 .yarnrc.yml                                   |  18 ++++
 lavamoat/webpack/mv2/beta/policy.json         |  23 +++--
 lavamoat/webpack/mv2/experimental/policy.json |  23 +++--
 lavamoat/webpack/mv2/flask/policy.json        |  23 +++--
 lavamoat/webpack/mv2/main/policy.json         |  23 +++--
 lavamoat/webpack/mv3/beta/policy.json         |  23 +++--
 lavamoat/webpack/mv3/experimental/policy.json |  23 +++--
 lavamoat/webpack/mv3/flask/policy.json        |  23 +++--
 lavamoat/webpack/mv3/main/policy.json         |  23 +++--
 yarn.lock                                     | 141 ++++++++++++++++++++------
 10 files changed, 256 insertions(+), 87 deletions(-)

== manifest ==

_{Produced by capture.sh, not transcribed. head c08a8bb748f28dccb96879baec496aa279071421 · 0 tracked changes · node v22.23.1 · Python 3.12.3 · yarn.lock 20a3c61f72380484. Run: https://github.com/MajorLift/metamask-skills/actions/runs/30765367843 — logs and artifacts attached there.}

Follows from the scope above

• package.json is untouched. Every moved version is transitive, resolved in yarn.lock, so nothing here is a declared-dependency change a reader would see in the manifest.
• The eight LavaMoat policies each gain 23 lines. Regenerated from a real run, so those are capabilities the new resolutions actually exercise.
• The reviewable decisions are three advisory suppressions in .yarnrc.yml#L42-L59, each with its reasoning written next to it:

advisory	suppressed because
GHSA-wrjc-x8rr-h8h6	HashRouter, not BrowserRouter — no attacker-controlled server paths
GHSA-jjmj-jmhj-qwj2	same routing model; no browser-history paths from a server
GHSA-337j-9hxr-rhxg	no server-side rendering or React Router hydration

Raise with a human: each rationale is a claim about how the extension uses React Router, and a suppression outlives the reasoning that justified it — if the app ever adopts BrowserRouter or SSR, these three entries keep the advisories silent with no signal that their premise expired. Whether that is acceptable, and whether the premises hold today across every routed surface, is a judgement this run does not make.