[Snyk] Security upgrade tar from 4.4.19 to 6.2.1

[hkambham]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	718/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.5	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: tar

The new version differs by 167 commits.

• c65f76d 6.2.1
• ffe6824 prevent extraction in excessively deep subfolders
• fe7ebfd remove security.md
• 5bc9d40 6.2.0
• fe1ef5e changelog 6.2
• e483220 get rid of npm lint stuff
• 689928a ci that works outside of npm org
• db6f539 file inference improvements for .tbr and .tgz
• 336fa8f refactor: dry and other pr comments
• eeba222 chore: lint fixes
• c9fc57c feat: add initial support for brotli
• 8c5af15 silence dependabot
• 3302cf7 6.1.15
• 4501bdb Normalize unicode internally using NFD
• 24efc74 remove parallelism causing test/pack.js to be flaky
• 8cd8139 move mutateFS reset out of t.teardown
• 4aaffc8 6.1.14
• 4cbdd67 deps: [email protected]
• 75d3081 fix: update repository url in package.json
• 82bb328 chore: postinstall for dependabot template-oss PR
• 5f31636 chore: bump @ npmcli/template-oss from 4.10.0 to 4.11.0
• a044a87 chore: release 6.1.13 (#344)
• cc4e0dd deps: bump minipass from 3.3.6 to 4.0.0
• 5dcfcb3 chore: bump events-to-array from 1.1.2 to 2.0.3

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Resource Consumption ('Resource Exhaustion')