Bump tar and @angular/cli

[dependabot]

Bumps tar to 7.5.13 and updates ancestor dependency @angular/cli. These dependencies need to be updated together.

Updates tar from 6.2.1 to 7.5.13

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• d6611ae 7.5.13
• 119c401 fix(extract): prevent raced symlink writes outside cwd
• 2a294d3 7.5.12
• 01082a4 fix: reject top promise on floating addFilesAsync rejections
• dd1c36a linting
• 35a1ffe doc: more clarity in security warning
• bf776f6 7.5.11
• f48b5fa prevent escaping symlinks with drive-relative paths
• 97cff15 docs: more security info
• 2b72abc 7.5.10
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @angular/cli from 18.2.2 to 21.2.5

Release notes

Sourced from @​angular/cli's releases.

21.2.5

@​angular/cli

Commit	Description
	support custom port in MCP devserver start tool

@​angular/ssr

Commit	Description
	allow underscores in host validation
	patch Headers.forEach in cloneRequestAndPatchHeaders

21.2.4

@​angular/cli

Commit	Description
	restore console methods after logger completes

@​angular/build

Commit	Description
	deduplicate and merge coverage excludes with vitest
	prevent reporter duplicates by explicitly overriding Vitest configuration
	remove default for unit-test coverage option
	warn about performance of test.exclude in vitest configuration
	warn when vitest watch config conflicts with builder

@​angular/ssr

Commit	Description
	apply forwarded prefix and vary header in accept-language redirects
	support '*' in allowedHosts and warn about security risks

21.2.3

@​angular/cli

Commit	Description
	use parsed package name for migrate-only updates

@​angular/build

Commit	Description
	alias createRequire banner import to avoid duplicate binding
	only use external packages for polyfills when no local files are present

@​angular/ssr

Commit	Description
	disallow x-forwarded-prefix starting with a backslash
	ensure unique values in redirect response Vary header
	support custom headers in redirect responses

21.2.2

@​angular/cli

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/cli's changelog.

21.2.5 (2026-03-27)

@​angular/cli

Commit	Type	Description
cadf9b201	feat	support custom port in MCP devserver start tool

@​angular/ssr

Commit	Type	Description
bbc255419	fix	allow underscores in host validation
b1fe66a7f	fix	patch Headers.forEach in cloneRequestAndPatchHeaders

20.3.22 (2026-03-27)

@​angular-devkit/build-angular

Commit	Type	Description
5978eeeff	fix	update picomatch to 4.0.4

@​angular-devkit/core

Commit	Type	Description
6e9b92612	fix	update picomatch to 4.0.4

@​angular/build

Commit	Type	Description
6f209c26d	fix	update picomatch to 4.0.4

19.2.23 (2026-03-27)

@​angular/cli

Commit	Type	Description
67cfbe32f	fix	update picomatch to 4.0.4

... (truncated)

Commits

• 3018612 release: cut the v21.2.5 release
• 349bd43 build: update dependency picomatch to v4.0.4
• cadf9b2 feat(@​angular/cli): support custom port in MCP devserver start tool
• bbc2554 fix(@​angular/ssr): allow underscores in host validation
• 88ac998 build: update cross-repo angular dependencies
• 022e0ef build: update github/codeql-action action to v4.34.1
• c363f19 build: update dependency node to v22.22.2
• b1fe66a fix(@​angular/ssr): patch Headers.forEach in cloneRequestAndPatchHeaders
• 2aa93fc release: cut the v21.2.4 release
• f33826e build: update cross-repo angular dependencies
• Additional commits viewable in compare view