chore(deps): bump tar from 7.5.21 to 7.5.22

[dependabot]

Bumps tar from 7.5.21 to 7.5.22.

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• See full diff in compare view

[cursor]

PR Summary

Low Risk
Patch dependency bump with no source changes; blast-radius tarball extraction still uses the same API, with only a minor upstream option-handling fix.

Overview
Bumps the direct tar dependency in packages_worker from 7.5.21 to 7.5.22 and refreshes pnpm-lock.yaml so the workspace resolves that version (including dropping minipass@7.0.4 in favor of 7.1.3 on the tar graph).

That package is used when downloading and extracting npm tarballs for blast-radius work, so this is a patch-level library update only—no application code changes. The upstream 7.5.22 release includes a small behavior fix allowing a falsey transform option.

^{Reviewed by Cursor Bugbot for commit d5e276f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f051a3d. Configure here.}

[cursor]

Needle resolved via SSH git

High Severity

clearbit's needle dependency was rewritten from an HTTPS codeload.github.com tarball to a type: git resolution with repo: git@github.com:clearbit/needle.git. Fresh installs and CI using pnpm i --frozen-lockfile without GitHub SSH credentials can fail when fetching that package.

Additional Locations (2)

• pnpm-lock.yaml#L15675-L15676
• pnpm-lock.yaml#L18534-L18535

 

^{Reviewed by Cursor Bugbot for commit f051a3d. Configure here.}