chore(deps): bump tar and ls-engines

[dependabot]

Bumps tar to 7.5.13 and updates ancestor dependency ls-engines. These dependencies need to be updated together.

Updates tar from 6.2.1 to 7.5.13

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• d6611ae 7.5.13
• 119c401 fix(extract): prevent raced symlink writes outside cwd
• 2a294d3 7.5.12
• 01082a4 fix: reject top promise on floating addFilesAsync rejections
• dd1c36a linting
• 35a1ffe doc: more clarity in security warning
• bf776f6 7.5.11
• f48b5fa prevent escaping symlinks with drive-relative paths
• 97cff15 docs: more security info
• 2b72abc 7.5.10
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates ls-engines from 0.9.3 to 0.10.0

Changelog

Sourced from ls-engines's changelog.

v0.10.0 - 2025-12-22

Commits

• [Dev Deps] update eslint, @ljharb/eslint-config 9bdfde1
• [Refactor] switch from yargs to pargs 52031da
• [Refactor] extract fulfilled result processing into separate module 6621295
• [Deps] remove unused and no-longer-needed deps 04c90fb
• [Refactor] use util.styleText instead of colors b77a164
• [Tests] add regression test for --save flag modifying package.json fb74dd9
• [Refactor] convert CLI entrypoint to ESM f5f4084
• [Breaking] require node 22 9d4fbbc
• [Fix] correctly extract save function from fulfilled result value 4d04d3c
• [Deps] update @npmcli/arborist, json-file-plus, pacote a6f1e0e
• [Dev Deps] update nyc 1569183
• [Dev Deps] update npmignore b1342bb
• [Deps] update json-file-plus fa28493
• [Deps] update get-dep-tree 53f3cfa
• [Dev Deps] update @ljharb/eslint-config db2c528

v0.9.4 - 2025-12-16

Commits

• [New] add devEngines support e474d52
• [Tests] update fixtures 922454d
• [Tests] increase coverage 8fddd8e
• [Tests] peer-subset-root: add peer dep as devDep for consistent install across npm versions 37c0e32
• [Fix] checkCurrent: use the computed graphValid, not the graphValids object c90bdf7
• [Refactor] make the engines field name dynamic c3d0bd1
• [Tests] add coverage bfc1a2d
• [Tests] add coverage for getGraphEntries default values 9ad3ae1
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, es-value-fixtures, npmignore, object-inspect, tape 19b7f79
• [Deps] update json-file-plus, lockfile-info, object.values, semver, table 0575332
• [Dev Deps] use npm audit instead of aud 7739d61
• [Dev Deps] add missing peer dep ff8df75

Commits

• 8524cce v0.10.0
• 1569183 [Dev Deps] update nyc
• b1342bb [Dev Deps] update npmignore
• 6621295 [Refactor] extract fulfilled result processing into separate module
• 4d04d3c [Fix] correctly extract save function from fulfilled result value
• fb74dd9 [Tests] add regression test for --save flag modifying package.json
• fa28493 [Deps] update json-file-plus
• 04c90fb [Deps] remove unused and no-longer-needed deps
• 53f3cfa [Deps] update get-dep-tree
• b77a164 [Refactor] use util.styleText instead of colors
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ls-engines@​0.9.3 ⏵ 0.10.0	+2		+2	+9

View full report