fix(deps): bump tar from 7.5.15 to 7.5.21

[dependabot]

Bumps tar from 7.5.15 to 7.5.21.

Commits

• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli-web-cli	Ready	Preview, Comment	Jul 26, 2026 1:07pm

[ci-lockfile-regen]

Dependabot Fix Assessment

Package: `tar` `7.5.15` → `7.5.21` (patch)
Scope: runtime dependency (dependencies)
Workspace: root

What changed upstream

• Multiple CVEs fixed in tar 7.5.12–7.5.21
• Critical: GHSA-23hp-3jrh-7fpw (CVSS 9.2) fixed in 7.5.19
• tar releases

Root cause of CI failure

The security audit failed because of a stale pnpm override in package.json:

"tar@<7.5.11": "7.5.11"

This override was written at an earlier point to force transitive tar dependencies up to 7.5.11. But 7.5.11 is itself now vulnerable. Dependabot updated the direct dependency to 7.5.21, but didn't update this override — so transitive consumers of tar continued to resolve to 7.5.11 (the floor set by the old override), which still appeared in pnpm-lock.yaml and triggered the critical CVSS 9.2 finding.

Migration concerns checked

• Peer dependencies: OK
• Type changes: N/A (no API change in this patch range)
• Config files: OK
• Module format: OK (no ESM/CJS change)
• React compatibility: N/A
• Monorepo impact: Only root lockfile affected; examples/web-cli and packages/react-web-cli don't depend on tar directly

What broke

• Security Audit (osv-scanner): tar@7.5.11 present in pnpm-lock.yaml as a transitive dependency forced there by the stale override. GHSA-23hp-3jrh-7fpw (CVSS 9.2) — fixed in 7.5.19.

What was fixed

• Updated the pnpm override from "tar@<7.5.11": "7.5.11" to "tar@<7.5.21": "7.5.21" in package.json
• Regenerated pnpm-lock.yaml — tar@7.5.11 no longer appears; all transitive tar deps now resolve to 7.5.21

Verification

• Build: ✅
• Lint: ✅ (0 errors)
• Unit tests: ✅ (186 test files, 2534 tests passed)
• Web CLI tests: ✅ (57 passed, 6 skipped)

Notes for reviewer

The other 100 non-critical vulnerabilities shown in the audit log (vite, brace-expansion, minimatch, postcss, etc.) were already present before this PR — they are all in the examples/web-cli and packages/react-web-cli workspaces and are pre-existing issues unrelated to the tar bump. The audit only fails on critical severity (CVSS ≥ 9.0), which is now resolved.