chore(deps): bump tar and npm - #257
Conversation
dependabot
Bot
added
dependencies
Bumps [tar](https://github.com/isaacs/node-tar) and [npm](https://github.com/npm/cli). These dependencies needed to be updated together. Updates `tar` from 7.5.16 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.16...v7.5.22) Updates `npm` from 11.17.0 to 11.19.1 - [Release notes](https://github.com/npm/cli/releases) - [Changelog](https://github.com/npm/cli/blob/v11.19.1/CHANGELOG.md) - [Commits](npm/cli@v11.17.0...v11.19.1) --- updated-dependencies: - dependency-name: npm dependency-version: 11.19.1 dependency-type: indirect - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
c40b4c2 to
cb0dad0
Compare
dhensby
left a comment
dhensby
left a comment
There was a problem hiding this comment.
Approving — tar 7.5.16 → 7.5.22 and npm 11.17.0 → 11.19.1, transitive dev-scope (lockfile-only). Dependabot correctly pairs them: the tar advisory can only be cleared through the npm bump.
Why these two must move together
npm vendors its whole dependency tree inside its published tarball (inBundle: true). A bundled dependency cannot be overridden from a consuming lockfile — so a vulnerable tar under node_modules/npm/node_modules/tar stays vulnerable no matter what the lockfile says. It clears only when npm itself ships a release whose bundle has been refreshed.
That is exactly what has happened here: npm 11.19.1 declares tar: ^7.5.22, which is above the advisory's >7.5.20 threshold. Earlier 11.x releases still bundled 7.5.19 and could not resolve it.
Supply chain
tar@7.5.22 |
npm@11.19.1 |
|
|---|---|---|
| Publisher | isaacs <i@izs.me> |
reggi <reggi@github.com> |
| Continuity | unchanged — isaacs also published 7.5.16 |
changed from owlstronaut at 11.19.0 — see below |
| Repository | github.com/isaacs/node-tar ✅ matches |
github.com/npm/cli ✅ matches |
| Install hooks | prepare only — byte-identical to 7.5.16, so pre-existing, and prepare never runs for a registry tarball |
none |
| Published | 2026-07-24T15:48:51Z |
2026-08-26T21:47:53Z |
On the npm publisher change, since a new publishing identity is normally worth stopping for:
reggiis a listed maintainer of thenpmpackage on the registry (alongsidesaquibkhanandnpm-cli-ops) — not an unknown account.- The address is
@github.com, consistent with npm being GitHub-operated, and therepositoryfield is unchanged. - It is a sustained rotation rather than a one-off:
reggipublished both 11.19.0 and 11.19.1. - The GitHub release
v11.19.1was cut bygithub-actions[bot]at21:48:47Zagainst npm's publish at21:47:53Z— 54 seconds apart.
Taken together this is a maintainer rotation within the npm CLI team, not an unexplained identity change.
Scope
Lockfile-only and dev-scope — neither package is imported by this library, and neither reaches its consumers.
CI
Green across the full matrix — 16.x, 18.x, 20.x, 22.x, 24.x, plus lint and coverage.
1 participant
Bumps tar and npm. These dependencies needed to be updated together.
Updates
tarfrom 7.5.16 to 7.5.22Commits
2a22bfc7.5.22df1cd8dAllow transform to be falsey0cd9cc37.5.21631ae59list: prevent unbounded recursionebbb7207.5.202f27196fix: fully disable and dispose of unzip when aborting parserbe440da7.5.192812e93add maxDecompressionRatio guard against explosive decompression9ecd4d27.5.189e78bf0refuse to let header size be less than 0Updates
npmfrom 11.17.0 to 11.19.1Release notes
Sourced from npm's releases.
... (truncated)
Changelog
Sourced from npm's changelog.
... (truncated)
Commits
3acf9a7chore: release 11.19.183b750dfix: exempt explicit pack targets from allow-directory (#9916)4791b27deps: undici@6.28.0823d647deps: ip-address@10.5.004f8efedeps: brace-expansion@5.0.91610280deps: tar@7.5.22 (#9842)bfacd33chore: release 11.19.03529ca2fix(pack): honor min-release-age-exclude (#9811)67f12aefix(owner): use scoped registry for user lookup (#9810)aea0c6efix(arborist): avoid crash when peer back-off detaches a node (#9808)