From d91763f9d3845b0ddd913fa4917c2f8c9ea2d78c Mon Sep 17 00:00:00 2001
From: Brandon Schneider <ceo@sovereign-stack.local>
Date: Sat, 30 May 2026 00:37:43 -0500
Subject: [PATCH] fix(deps): update tar to v0.4.46 and refresh npm packages

Resolves GHSA-9rg2-7cm8 (PAX header desynchronization) in:
- 2-Search-Space/search/stract/Cargo.lock
- 4-Infrastructure/servo-fetch/Cargo.lock

Note: @ai-sdk/provider-utils in dify-ai-provider nested dep (3.0.25)
has no fix available yet; tracked in GHSA-866g-f22w-33x8
---
 2-Search-Space/search/stract/Cargo.lock |  6 +++---
 4-Infrastructure/servo-fetch/Cargo.lock | 14 +++++++-------
 package-lock.json                       |  1 +
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/2-Search-Space/search/stract/Cargo.lock b/2-Search-Space/search/stract/Cargo.lock
index eecd02e5..c4ee45b3 100644
--- a/2-Search-Space/search/stract/Cargo.lock
+++ b/2-Search-Space/search/stract/Cargo.lock
@@ -5440,9 +5440,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tar"
-version = "0.4.45"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
 dependencies = [
  "filetime",
  "libc",
@@ -6402,7 +6402,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
diff --git a/4-Infrastructure/servo-fetch/Cargo.lock b/4-Infrastructure/servo-fetch/Cargo.lock
index 4b6f3648..6fd2d196 100644
--- a/4-Infrastructure/servo-fetch/Cargo.lock
+++ b/4-Infrastructure/servo-fetch/Cargo.lock
@@ -1773,7 +1773,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5671,7 +5671,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5729,7 +5729,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -8033,9 +8033,9 @@ dependencies = [
 
 [[package]]
 name = "tar"
-version = "0.4.45"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
 dependencies = [
  "filetime",
  "libc",
@@ -8052,7 +8052,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -9234,7 +9234,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/package-lock.json b/package-lock.json
index fa80ba5f..409b001b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,6 +6,7 @@
     "": {
       "name": "research-stack",
       "dependencies": {
+        "@ai-sdk/provider-utils": "^4.0.27",
         "@cline/sdk": "^0.0.41",
         "@modelcontextprotocol/inspector": "^0.21.2",
         "@modelcontextprotocol/sdk": "^1.29.0",