[DPEDE-1784](deps): Bump tar from 7.5.13 to 7.5.16

[dependabot]

Bumps tar from 7.5.13 to 7.5.16.

Commits

• cf21338 7.5.16
• 21a8220 do not apply PAX header fields to meta entries
• 52632cf update project deps
• 302f51f fix inconsequential typo in PENDINGLINKS symbol name
• 55dbb99 remove some uses of mutate-fs
• 87cc309 7.5.15
• 7aef486 fix: regression in pending links detection
• 6244eb3 7.5.14
• 9704d8c stricter protection against hardlinks preempting their targets
• 700734f update workflows and deps
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2104/1/. ❌

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Routine security patch (tar 7.5.13→7.5.16) that fixes one medium advisory with no code impact; escalated solely because the default-branch critical-check pass-rate is 64%.

TL;DR

• Merge: 🔍 review CI health, then merge — the dependency is safe and fixes a medium advisory, but critical-check pass-rate on master is 64%; confirm the pre-existing failures are unrelated to this PR before merging.
• Breaks your code? ✅ Most likely not — tar is not imported anywhere in this repository.
• Security? ✅ this bump fixes GHSA-vmf3-w455-68vh (CVE-2026-53655, medium) — no advisories remain for 7.5.16.
• Update: tar — you have 7.5.13, this PR installs 7.5.16 (patch, spans 3 releases). Fixes 1 medium advisory (PAX header file-smuggling), no code impact.

Signal	Value	Interpretation
Bump type	patch	Third version component incremented only (7.5.13→7.5.16); semver contract guarantees backward-compatible bug/security fixes.
Dependency risk	low	Patch bump with zero confirmed in-repo impact. tar is not imported in this repo (0 hits across all scanned files for all npm import forms). The 7.5.13→7.5.16 changelog entries are all bug/security fixes ("Only read from ustar block if not specified in Pax", "Fix sync tar.list when file size reduces while reading", "Sanitize absolute linkpaths properly", "Prevent writing hardlink entries ahead of their file target") — no breaking changes.
Security risk	low	No advisories affect 7.5.16. This bump specifically resolves GHSA-vmf3-w455-68vh (CVE-2026-53655, medium, PAX header smuggling — range ≤ 7.5.15, first patched 7.5.16). All other listed advisories in the tar advisory history affect ranges below 7.5.13 and were already fixed before the old version.
CI health risk	high	28 critical runs on master; pass 64.3% (≈18/28), flakiness 0% → ci_confidence: low. The 9 Push on master runs are all green (9/9). Failures are concentrated in Dependabot grouped-update workflows for other packages (@babel/preset-env, nuxt, vite, etc.) which the pre-step classified as critical. No informational workflows were excluded. This is a pre-existing repo-wide CI condition unrelated to this tar bump.
API usage in repo	false	Scanned for all npm import forms (import … from 'tar', require('tar'), import('tar'), export … from 'tar') — 0 hits. tar is a transitive build-tooling dependency; no application code imports it directly.
Cross-repo signal	standalone	No publishable root manifest found in the repository root.
Data completeness	complete	All 5 signals obtained: classification ✓, API usage ✓, release notes ✓, CI health ✓, cascade ✓.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI low — default-branch critical-check pass-rate is 64.3% (28 runs). No dependency or security risk fired.

Escalation category: ci-health — a green-dependency PR escalated purely on failing critical checks.

Confidence breakdown — score: 0.85.

• ✅ patch bump — semver-compatible by contract

• ✅ tar not imported in this repo — blast radius zero

• ✅ GHSA-vmf3-w455-68vh fixed by this bump; no advisories remain for 7.5.16

• ✅ No breaking changes in 7.5.13→7.5.16 range

• ✅ No cascade conflicts — no other open Dependabot PRs for tar

• ✅ All 5 signals obtained — complete data

• ⚠️ Critical CI confidence low (pass 64.3%, 28 runs) — deducted 0.15

• 💡 To reach a lower route: Resolve the failing critical-check workflows on master (primarily the grouped Dependabot update PRs for @babel/preset-env and related packages) so the critical-check pass-rate rises to ≥70% (medium) or ≥90% (high). Once CI confidence is medium or higher, this PR routes spot_check; with high CI it routes auto_eligible. Note: fixing informational workflows (Dependency Submission, etc.) will NOT change the route since they are already excluded from CI scoring.

What AiFEL checked

1. Triage — classified patch (tar 7.5.13→7.5.16).
2. Symbol extraction — 0 import sites across 0 files (all four npm import forms scanned; none found).
3. Release-notes comparator — changelog for 7.5.13→7.5.16 available; entries are all security/bug fixes ("Sanitize absolute linkpaths properly", "Only read from ustar block if not specified in Pax", etc.); no breaking changes; one medium advisory (GHSA-vmf3-w455-68vh) fixed.
4. CI health — 28 critical runs: pass 64.3%, flaky 0% → confidence low; informational excluded: none.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. tar is not imported anywhere in this repository's source files, so the bumped package is transitive-only and the documented changes in this patch range touch no API you call.

Security advisories

✅ Nothing still affects 7.5.16

✅ Resolved by this bump (1): GHSA-vmf3-w455-68vh (CVE-2026-53655) — medium severity; CVSS not scored; no action needed (this bump IS the fix).

What it fixed: node-tar applied the PAX header size field to intermediary GNU long-name/long-link headers, creating a tar-parser interpretation differential that could allow file smuggling. Affected range: ≤ 7.5.15; first patched: 7.5.16 (this PR's target version).

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	tar	7.5.13	7.5.16	routine patch — fixes GHSA-vmf3-w455-68vh (medium); no code impact

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "patch",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.85,
  "packages": [
    {
      "ecosystem": "npm",
      "name": "tar",
      "old_version": "7.5.13",
      "new_version": "7.5.16"
    }
  ],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Routine patch bump of tar 7.5.13→7.5.16 fixes one medium advisory (GHSA-vmf3-w455-68vh, CVE-2026-53655); tar is not imported in this repo so there is zero code impact; escalated because critical-check CI pass-rate on master is 64.3% (ci_confidence: low).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2104",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience

[dependabot]

Superseded by #2127.

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources