The @progress/kendo-ui npm package creates the following dependency tree:

@progress/kendo-ui 2026.1.415
 |
  - @progress/kendo-pdfviewer-common ^0.6.4 -> 0.6.4
    |
     - pdfjs-dist 4.6.82 -> 4.6.82
       |
        - canvas ^2.11.2 -> 2.11.2
          |
           - @mapbox/node-pre-gyp ^1.0.0 -> 1.0.11
             |
              - tar ^6.1.11 -> 6.2.1

All packages have been updated to the latest version possible.

Versions <= 7.5.10 of tar have multiple known vulnerabilities:

• node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - https://github.com/advisories/GHSA-34x7-hfp2-rc4v
• node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
• Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction - https://github.com/advisories/GHSA-83g3-92jg-28cx
• tar has Hardlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-qffp-2rhf-9h96
• node-tar Symlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-9ppj-qmqm-q256
• Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w