Bump tar from 7.4.3 to 7.5.22

[dependabot]

Bumps tar from 7.4.3 to 7.5.22.

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

---

Note

Low Risk
Lockfile-only transitive dependency bump for Expo CLI’s tar usage; no application source changes, though tar unpack behavior changes could affect install/tooling paths that extract archives.

Overview
Updates package-lock.json only: tar moves from 7.4.3 to 7.5.22 (pulled in via @expo/cli), with transitive minizlib 3.0.2 → 3.1.0. The lockfile drops tar’s nested mkdirp dependency and records resolved/integrity metadata for the bumped packages.

The newer tar release line includes security and robustness fixes (e.g. link-path sanitization, decompression ratio limits, listing/recursion guards) plus zstd support and TOCTOU/listing behavior improvements noted in the upstream changelog.

^{Reviewed by Cursor Bugbot for commit 579ed34. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.