deps: tar@7.5.22 (#9843)

## Summary

Updates the bundled `tar` dependency from `7.5.19` to `7.5.22` on the
latest npm 12 branch.

This resolves
[GHSA-r292-9mhp-454m](GHSA-r292-9mhp-454m),
which affects `tar` versions through `7.5.20`. All production dependency
paths now resolve to `tar@7.5.22`.

## Testing

- `node . run dependencies --ignore-scripts`
- `node . ls tar --all --omit=dev`
- `node . audit --omit=dev --json` reports no `tar` vulnerability
- `node . test --ignore-scripts` reports the environment-specific
`EXDEV` failure in `test/bin/windows-shims.js`; all other tests pass

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: martinrrm

node_modules/tar/dist/commonjs/index.min.js

@@ -59,14 +59,22 @@ const onReadEntryFunction = (opt) => {
 const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [(0, strip_trailing_slashes_js_1.stripTrailingSlashes)(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || (0, path_1.parse)(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root);
+            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;

node_modules/tar/dist/commonjs/list.js

@@ -376,6 +376,16 @@ class Parser extends events_1.EventEmitter {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode

node_modules/tar/dist/commonjs/parse.js

@@ -20,14 +20,22 @@ const onReadEntryFunction = (opt) => {
 export const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [stripTrailingSlashes(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || parse(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas(dirname(file), root);
+            ret = m !== undefined ? m : mapHas(dirname(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;

node_modules/tar/dist/esm/index.min.js

@@ -373,6 +373,16 @@ export class Parser extends EE {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode

node_modules/tar/dist/esm/list.js

@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter",
   "name": "tar",
   "description": "tar for node",
-  "version": "7.5.19",
+  "version": "7.5.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"

node_modules/tar/dist/esm/parse.js

@@ -148,7 +148,7 @@
         "spdx-expression-parse": "^4.0.0",
         "ssri": "^14.0.0",
         "supports-color": "^10.2.2",
-        "tar": "^7.5.19",
+        "tar": "^7.5.22",
         "text-table": "~0.2.0",
         "tiny-relative-date": "^2.0.2",
         "treeverse": "^3.0.0",
@@ -13779,9 +13779,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.19",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.19.tgz",
-      "integrity": "sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "inBundle": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {

node_modules/tar/package.json

@@ -109,7 +109,7 @@
     "spdx-expression-parse": "^4.0.0",
     "ssri": "^14.0.0",
     "supports-color": "^10.2.2",
-    "tar": "^7.5.19",
+    "tar": "^7.5.22",
     "text-table": "~0.2.0",
     "tiny-relative-date": "^2.0.2",
     "treeverse": "^3.0.0",