Bump tar and node-gyp

[dependabot]

Bumps tar to 7.5.22 and updates ancestor dependency node-gyp. These dependencies need to be updated together.

Updates tar from 6.1.12 to 7.5.22

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

• cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates node-gyp from 9.3.0 to 13.0.1

Release notes

Sourced from node-gyp's releases.

v13.0.1

13.0.1 (2026-07-02)

Core

• deps: bump undici from 6.26.0 to 8.4.1 (#3330) (2c95a19)

Miscellaneous

• fix windows vs2026 version (#3338) (5a835ea)

v13.0.0

13.0.0 (2026-06-10)

⚠ BREAKING CHANGES

• node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• bump to new node engine range (b792b8e)

Bug Fixes

• ci: update ruff-action version to v4.0.0 (#3324) (f089669)
• disable LTO for addon builds on Windows (#3331) (d30bb6e)

Core

• deps: bump actions/github-script from 8 to 9 (#3297) (f6a5e45)
• deps: bump googleapis/release-please-action from 4 to 5 (#3307) (b2cde80)
• nopt@10.0.0 (327424a)
• proc-log@7.0.0 (f6c296b)
• which@7.0.0 (11a8b10)

Miscellaneous

• add commit-lint (#3325) (6fb6c11)

v12.4.0

12.4.0 (2026-05-15)

Features

... (truncated)

Changelog

Sourced from node-gyp's changelog.

13.0.1 (2026-07-02)

Core

• deps: bump undici from 6.26.0 to 8.4.1 (#3330) (2c95a19)

Miscellaneous

• fix windows vs2026 version (#3338) (5a835ea)

13.0.0 (2026-06-10)

⚠ BREAKING CHANGES

• node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• bump to new node engine range (b792b8e)

Bug Fixes

• ci: update ruff-action version to v4.0.0 (#3324) (f089669)
• disable LTO for addon builds on Windows (#3331) (d30bb6e)

Core

• deps: bump actions/github-script from 8 to 9 (#3297) (f6a5e45)
• deps: bump googleapis/release-please-action from 4 to 5 (#3307) (b2cde80)
• nopt@10.0.0 (327424a)
• proc-log@7.0.0 (f6c296b)
• which@7.0.0 (11a8b10)

Miscellaneous

• add commit-lint (#3325) (6fb6c11)

12.4.0 (2026-05-15)

Features

• update gyp-next to v0.22.2 (#3316) (8ea71e5)

... (truncated)

Commits

• cd5c9b1 chore(main): release 13.0.1 (#3332)
• 5a835ea chore: fix windows vs2026 version (#3338)
• 2c95a19 build(deps): bump undici from 6.26.0 to 8.4.1 (#3330)
• 866daaf chore(main): release 13.0.0 (#3323)
• f089669 fix(ci): update ruff-action version to v4.0.0 (#3324)
• 6fb6c11 chore: add commit-lint (#3325)
• d30bb6e fix: disable LTO for addon builds on Windows (#3331)
• 11a8b10 deps: which@7.0.0
• f6c296b deps: proc-log@7.0.0
• 327424a deps: nopt@10.0.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for node-gyp since your current version.

[birme]

Thanks for the automated bump, @dependabot — this PR has been reviewed by the node-srt triage bot.

Verdict: Tier B — hand to human maintainer

This PR bumps node-gyp from 9.3.0 → 13.0.1 (a major version jump across four major versions). node-gyp is a build-critical dependency that compiles and links the native N-API addon; per the project merge policy, any bump of node-gyp or node-addon-api — regardless of size — is Tier B and requires a human maintainer to validate before merging. The node-gyp 13 changelog shows a significant breaking change: its new engine requirement is ^22.22.2 || ^24.15.0 || >=26.0.0, which would effectively drop Node 18 and Node 20 support from this package.

tar is also bumped across a major boundary (6.1.12 → 7.5.22), which brings a rewrite in TypeScript, ESM/CJS hybrid output, and new chmod behavior defaults — worth a manual check for any downstream usage.

Additionally, CI is currently red across all Node versions (18, 20, 22, 24, 26), so this cannot be merged in its current state. The node-gyp 13 engine-range restriction is the most likely root cause.

What a human maintainer should evaluate:

1. Whether to adopt node-gyp 13 and update the CI matrix to reflect its new supported Node range (dropping 18/20, adding 24/26 if desired).
2. Whether any internal usage of tar is affected by the 6→7 major-API changes.
3. Once CI is green (or the matrix is appropriately narrowed), this can be merged.

ready-for-maintainer label applied.

node-srt maintenance bot — Tier B (build-critical dep major bump; CI red across all Node versions).