[Snyk] Security upgrade tar from 6.2.0 to 7.5.7

[maidul98]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• npm/package.json
• npm/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-TAR-15032660	693

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

[greptile-apps]

Greptile Overview

Greptile Summary

This PR upgrades the tar package from v6.2.0 to v7.5.7 to fix a Medium severity Directory Traversal vulnerability (SNYK-JS-TAR-15032660, score 693).

Key Changes:

• tar upgraded from ^6.2.0 to ^7.5.7
• All transitive dependencies updated (minipass, minizlib, chownr, yallist, etc.)
• Removed deprecated dependencies (fs-minipass, mkdirp)
• Added new dependency @isaacs/fs-minipass

Breaking Change Alert:

• Node.js >=18 now required (previously Node.js >=10) - this may affect users on older Node versions
• The tar v7 API appears backward compatible for the specific usage in npm/src/index.cjs (using tar.x() with C and filter options)

Security Impact:

• Fixes directory traversal vulnerability where malicious tar archives could write files outside intended extraction directory
• No other security issues introduced by this change

Testing Recommendation:

• Verify the npm package installation works on Node.js 18+ environments
• Test tar extraction functionality in npm/src/index.cjs to ensure tar v7 API compatibility
• Document Node.js 18+ requirement for users

Confidence Score: 3/5

• Safe to merge with caution - addresses security vulnerability but introduces breaking Node.js version requirement
• Score reflects that while the security fix is critical and the code changes are minimal (dependency update only), there is a breaking change in Node.js version requirement (>=18) that could impact users. The tar API usage appears compatible, but should be tested before release.
• Verify npm/src/index.cjs works correctly with tar v7 before publishing to npm

Important Files Changed

Filename	Overview
npm/package.json	Upgraded tar dependency from ^6.2.0 to ^7.5.7 to fix directory traversal vulnerability
npm/package-lock.json	Lock file updated with tar v7.5.7 and all transitive dependencies, includes Node.js >=18 requirement