Bump tar from 7.5.6 to 7.5.22

[dependabot]

Bumps tar from 7.5.6 to 7.5.22.

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[bert-e]

Hello dependabot[bot],

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request TBA
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

The following options are set: bypass_author_approval, bypass_jira_check

[bert-e]

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

The following options are set: bypass_author_approval, bypass_jira_check

[github-actions]

Dependency Bump Evaluation

Version change: 7.5.6 -> 7.5.22 (patch)
Breaking changes: None
Security concerns: None — this update IS a security fix

Changes (key patches):

• 7.5.19: Add maxDecompressionRatio guard against explosive decompression (zip bomb protection, default 1000:1 ratio)
• 7.5.21: Prevent unbounded recursion in list (DoS fix, capped at 100 depth)
• 7.5.20: Fully disable and dispose of unzip when aborting parser (resource leak fix)
• 7.5.18: Refuse to let header size be less than 0 (malformed archive guard)
• 7.5.22: Allow transform to be falsey (minor fix)

Impact on codebase: tar is a direct dependency but has no direct import/require in the source code. It is used indirectly in test workflow infrastructure (tests/workflows/). The security fixes protect against malicious tar archives regardless of usage pattern.

Maintainer change note: PR flags "isaacs" as a new releaser — this is the original creator and primary maintainer of node-tar, so this is expected.

Install script note: PR flags a new prepare script — standard for TypeScript packages (runs build step during install).

Recommendation: SAFE TO MERGE (after CI passes)

— Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: 7.5.6 -> 7.5.22 (16 patch releases)
Breaking changes: None
Security concerns: None with the update itself — this bump fixes 10 CVEs (1 Critical, 6 High, 3 Medium) including path traversal, symlink exploitation, decompression bomb, and DoS vectors. Merging promptly is recommended.

CVEs fixed:

• CVE-2026-59873 (Critical): Decompression bomb DoS via unlimited input
• CVE-2026-24842 (High): Arbitrary file read/overwrite via hardlink path traversal
• CVE-2026-26960 (High): File read/write via hardlink escape through symlinks
• CVE-2026-29786 (High): Hardlink path traversal via drive-relative linkpath
• CVE-2026-31802 (High): Symlink path traversal via drive-relative linkpath
• CVE-2026-59874 (High): Negative tar entry size causes infinite loop DoS
• CVE-2026-73566 (High): Uncontrolled recursion causes stack overflow DoS
• CVE-2026-53655 (Medium): PAX size override causes parser desync / file smuggling
• CVE-2026-59875 (Medium): Uncaught exception DoS via NUL byte in PAX path
• CVE-2026-59871 (Medium): Process crash via PAX numeric path type confusion

Impact on codebase: tar is a direct dependency but has no direct imports in Arsenal source code. No codebase patterns are affected by the behavioral tightening in these patches.

Install script note: Dependabot flagged a new prepare script — this is standard TypeScript build tooling (tshy && bash scripts/build.sh) by the package author (isaacs). Not a supply chain concern.

Maintainer note: Dependabot flagged isaacs as a new releaser — isaacs is the original creator and long-time maintainer of node-tar. This reflects an npm publishing account change, not a maintainer transfer.

CI status: Checks were still in progress at time of review.

Recommendation: SAFE TO MERGE

— Claude Code