Bump tar and ls-engines

[dependabot]

Bumps tar to 7.5.20 and updates ancestor dependency ls-engines. These dependencies need to be updated together.

Updates tar from 6.2.1 to 7.5.20

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates ls-engines from 0.9.4 to 0.10.1

Changelog

Sourced from ls-engines's changelog.

v0.10.1 - 2026-06-19

Commits

• [New] add types 13ff435
• [Tests] update fixtures 0b249a1
• [eslint] some cleanup c5046f7
• [actions] update workflows 0ceb848
• [Deps] update pargs 12170a9
• [Robustness] avoid .push, use void 79e28f2
• [Dev Deps] update auto-changelog, eslint, npmignore, tape 27c9468
• [meta] exclude some files from the publish ae9bf18
• [Refactor] store valid engines in an importable file c2cee45
• [Fix] use valid subpath imports specifier for node <24 301a113
• [eslint] fix errors 523e825
• [Deps] update pargs, semver afa5e63
• [Tests] update tape 7366498
• [Dev Deps] update eslint 3c8a241
• [Deps] update pargs 7c4b17d
• [readme] replace runkit CI badge with shields.io check-runs badge 46608fe
• [eslint] fix linting dd08850

v0.10.0 - 2025-12-22

Commits

• [Dev Deps] update eslint, @ljharb/eslint-config 9bdfde1
• [Refactor] switch from yargs to pargs 52031da
• [Refactor] extract fulfilled result processing into separate module 6621295
• [Deps] remove unused and no-longer-needed deps 04c90fb
• [Refactor] use util.styleText instead of colors b77a164
• [Tests] add regression test for --save flag modifying package.json fb74dd9
• [Refactor] convert CLI entrypoint to ESM f5f4084
• [Breaking] require node 22 9d4fbbc
• [Fix] correctly extract save function from fulfilled result value 4d04d3c
• [Deps] update @npmcli/arborist, json-file-plus, pacote a6f1e0e
• [Dev Deps] update nyc 1569183
• [Dev Deps] update npmignore b1342bb
• [Deps] update json-file-plus fa28493
• [Deps] update get-dep-tree 53f3cfa
• [Dev Deps] update @ljharb/eslint-config db2c528

Commits

• 5c0e7e3 v0.10.1
• ae9bf18 [meta] exclude some files from the publish
• 301a113 [Fix] use valid subpath imports specifier for node <24
• 523e825 [eslint] fix errors
• 3c8a241 [Dev Deps] update eslint
• 0ceb848 [actions] update workflows
• afa5e63 [Deps] update pargs, semver
• 7366498 [Tests] update tape
• 12170a9 [Deps] update pargs
• 13ff435 [New] add types
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ls-engines@​0.9.4 ⏵ 0.10.1	+1			+7

View full report

[dependabot]

Superseded by #1485.