Bump tar and node-gyp

[dependabot]

Bumps tar to 7.5.20 and updates ancestor dependency node-gyp. These dependencies need to be updated together.

Updates tar from 6.1.12 to 7.5.20

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

• cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates node-gyp from 9.3.0 to 13.0.1

Release notes

Sourced from node-gyp's releases.

v13.0.1

13.0.1 (2026-07-02)

Core

• deps: bump undici from 6.26.0 to 8.4.1 (#3330) (2c95a19)

Miscellaneous

• fix windows vs2026 version (#3338) (5a835ea)

v13.0.0

13.0.0 (2026-06-10)

⚠ BREAKING CHANGES

• node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• bump to new node engine range (b792b8e)

Bug Fixes

• ci: update ruff-action version to v4.0.0 (#3324) (f089669)
• disable LTO for addon builds on Windows (#3331) (d30bb6e)

Core

• deps: bump actions/github-script from 8 to 9 (#3297) (f6a5e45)
• deps: bump googleapis/release-please-action from 4 to 5 (#3307) (b2cde80)
• nopt@10.0.0 (327424a)
• proc-log@7.0.0 (f6c296b)
• which@7.0.0 (11a8b10)

Miscellaneous

• add commit-lint (#3325) (6fb6c11)

v12.4.0

12.4.0 (2026-05-15)

Features

... (truncated)

Changelog

Sourced from node-gyp's changelog.

13.0.1 (2026-07-02)

Core

• deps: bump undici from 6.26.0 to 8.4.1 (#3330) (2c95a19)

Miscellaneous

• fix windows vs2026 version (#3338) (5a835ea)

13.0.0 (2026-06-10)

⚠ BREAKING CHANGES

• node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

• bump to new node engine range (b792b8e)

Bug Fixes

• ci: update ruff-action version to v4.0.0 (#3324) (f089669)
• disable LTO for addon builds on Windows (#3331) (d30bb6e)

Core

• deps: bump actions/github-script from 8 to 9 (#3297) (f6a5e45)
• deps: bump googleapis/release-please-action from 4 to 5 (#3307) (b2cde80)
• nopt@10.0.0 (327424a)
• proc-log@7.0.0 (f6c296b)
• which@7.0.0 (11a8b10)

Miscellaneous

• add commit-lint (#3325) (6fb6c11)

12.4.0 (2026-05-15)

Features

• update gyp-next to v0.22.2 (#3316) (8ea71e5)

... (truncated)

Commits

• cd5c9b1 chore(main): release 13.0.1 (#3332)
• 5a835ea chore: fix windows vs2026 version (#3338)
• 2c95a19 build(deps): bump undici from 6.26.0 to 8.4.1 (#3330)
• 866daaf chore(main): release 13.0.0 (#3323)
• f089669 fix(ci): update ruff-action version to v4.0.0 (#3324)
• 6fb6c11 chore: add commit-lint (#3325)
• d30bb6e fix: disable LTO for addon builds on Windows (#3331)
• 11a8b10 deps: which@7.0.0
• f6c296b deps: proc-log@7.0.0
• 327424a deps: nopt@10.0.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for node-gyp since your current version.

[birme]

Thanks for the automated dependency update, Dependabot!

This PR is Tier B and cannot be auto-merged for two reasons:

1. Major node-gyp bump (9.3.0 → 13.0.1): node-gyp is a build-critical dependency that compiles the native addon — even minor changes here can break builds silently across platforms, and a 4-major-version jump warrants explicit human validation.
2. CI is red: Most CI checks are currently failing on this PR, so it cannot be merged regardless of tier.

Action needed: A human maintainer should evaluate whether node-gyp 13 is compatible with the current binding.gyp and src/ code (particularly its narrowed engine range ^22.22.2 || ^24.15.0 || >=26.0.0 which drops Node 18 and 20 support), investigate the CI failures, and decide whether to merge or close this PR in favour of a more targeted update.

The ready-for-maintainer label has been applied.

node-srt maintenance bot