build(deps): bump tar and ls-engines

[dependabot]

Bumps tar to 7.5.20 and updates ancestor dependency ls-engines. These dependencies need to be updated together.

Updates tar from 7.4.3 to 7.5.20

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates ls-engines from 0.9.4 to 0.10.1

Changelog

Sourced from ls-engines's changelog.

v0.10.1 - 2026-06-19

Commits

• [New] add types 13ff435
• [Tests] update fixtures 0b249a1
• [eslint] some cleanup c5046f7
• [actions] update workflows 0ceb848
• [Deps] update pargs 12170a9
• [Robustness] avoid .push, use void 79e28f2
• [Dev Deps] update auto-changelog, eslint, npmignore, tape 27c9468
• [meta] exclude some files from the publish ae9bf18
• [Refactor] store valid engines in an importable file c2cee45
• [Fix] use valid subpath imports specifier for node <24 301a113
• [eslint] fix errors 523e825
• [Deps] update pargs, semver afa5e63
• [Tests] update tape 7366498
• [Dev Deps] update eslint 3c8a241
• [Deps] update pargs 7c4b17d
• [readme] replace runkit CI badge with shields.io check-runs badge 46608fe
• [eslint] fix linting dd08850

v0.10.0 - 2025-12-22

Commits

• [Dev Deps] update eslint, @ljharb/eslint-config 9bdfde1
• [Refactor] switch from yargs to pargs 52031da
• [Refactor] extract fulfilled result processing into separate module 6621295
• [Deps] remove unused and no-longer-needed deps 04c90fb
• [Refactor] use util.styleText instead of colors b77a164
• [Tests] add regression test for --save flag modifying package.json fb74dd9
• [Refactor] convert CLI entrypoint to ESM f5f4084
• [Breaking] require node 22 9d4fbbc
• [Fix] correctly extract save function from fulfilled result value 4d04d3c
• [Deps] update @npmcli/arborist, json-file-plus, pacote a6f1e0e
• [Dev Deps] update nyc 1569183
• [Dev Deps] update npmignore b1342bb
• [Deps] update json-file-plus fa28493
• [Deps] update get-dep-tree 53f3cfa
• [Dev Deps] update @ljharb/eslint-config db2c528

Commits

• 5c0e7e3 v0.10.1
• ae9bf18 [meta] exclude some files from the publish
• 301a113 [Fix] use valid subpath imports specifier for node <24
• 523e825 [eslint] fix errors
• 3c8a241 [Dev Deps] update eslint
• 0ceb848 [actions] update workflows
• afa5e63 [Deps] update pargs, semver
• 7366498 [Tests] update tape
• 12170a9 [Deps] update pargs
• 13ff435 [New] add types
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	debug@​4.4.1 ⏵ 4.4.3
	ls-engines@​0.9.4 ⏵ 0.10.1	+1			+7

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm es-abstract is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/ls-engines@0.10.1 → npm/es-abstract@1.24.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report