Upgrade tar to 7.5.4 to address CVE-2026-23950

[Copilot]

tar 7.5.2 has two security vulnerabilities patched in 7.5.4:

• Race condition via Unicode ligature collisions on macOS APFS (≤7.5.3)
• Arbitrary file overwrite and symlink poisoning (≤7.5.2)

Changes

• Bump tar dependency from ^7.5.2 to ^7.5.4 in package.json

The tar package is used in lib/install.js for extracting Node.js header files during installation.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>CVE-2026-23950 - dependency update request for node-tard</issue_title>
<issue_description>GHSA-r6q2-hw4h-h46w

node-tar is currently 7.5.2, CVE patched in 7.5.4</issue_description>

<agent_instructions>Upgrade this dependency to avoid this CVE.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes CVE-2026-23950 - dependency update request for node-tard #3270

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.