Skip to content

Bump tar and vercel#28

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-73264422b2
Open

Bump tar and vercel#28
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-73264422b2

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 11, 2026

Bumps tar and vercel. These dependencies needed to be updated together.
Updates tar from 6.2.1 to 7.5.7

Changelog

Sourced from tar's changelog.

Changelog

7.5

  • Added zstd compression support.
  • Consistent TOCTOU behavior in sync t.list
  • Only read from ustar block if not specified in Pax
  • Fix sync tar.list when file size reduces while reading
  • Sanitize absolute linkpaths properly
  • Prevent writing hardlink entries to the archive ahead of their file target

7.4

  • Deprecate onentry in favor of onReadEntry for clarity.

7.3

  • Add onWriteEntry option

7.2

  • DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

  • Update minipass to v7.1.0
  • Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

  • Drop support for node <18
  • Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
  • Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
  • Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
  • Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.


Updates vercel from 34.2.6 to 50.15.1

Release notes

Sourced from vercel's releases.

vercel@50.15.1

Patch Changes

vercel@50.15.0

Minor Changes

  • Add vercel flags command to manage feature flags from the CLI. This includes subcommands for listing, inspecting, creating, deleting, archiving, enabling, and disabling feature flags, as well as managing SDK keys for flag evaluation. (#14710)

    New commands:

    • vercel flags ls - List all feature flags
    • vercel flags inspect <flag> - Display detailed information about a feature flag, including its variants
    • vercel flags add <slug> - Create a new feature flag
    • vercel flags rm <flag> - Delete a feature flag (must be archived first)
    • vercel flags archive <flag> - Archive a feature flag
    • vercel flags disable <flag> - Disable a flag in an environment
    • vercel flags enable <flag> - Enable a flag in an environment
    • vercel flags sdk-keys ls - List SDK keys
    • vercel flags sdk-keys add - Create a new SDK key
    • vercel flags sdk-keys rm <key> - Delete an SDK key

  • Add --metadata / -m flag to vercel integration add for non-interactive provisioning (#14871)

  • Add vc link add subcommand to append projects to existing repo.json (#14968)

  • [services] detect and manage virtual environments for Python services (#14952)

  • Improved startup time 1.2-1.5x for CLI commands by implementing a different bundling & lazy loading strategy (#14930)

    Specifically, speedup the following subcommands: deploy, env, list, link, build, dev (informed by telemetry end-user usage data). The rest of the commands also became faster due to reduced amount of code they need to load.

Patch Changes

  • Add vercel integration discover with human-readable and JSON output for installable marketplace integrations and products. (#14948)

  • Add service configuration to BuildOptions (#14918)

  • [cli] integration add: auto-connect resources to all environments and auto-run env pull after provisioning. Add --no-connect and --no-env-pull opt-out flags. Print resource dashboard URL on success. (#14964)

  • Write repo.json "orgId" field on a per-project basis (#14967)

    • Fix services routing for runtime entrypoints by using extensionless function destinations, disabling framework defaultRoutes injection during services builds, and ensuring deterministic route merging precedence for services. (#14946)
    • Scope route-owning builder routes to their owning service prefixes in services mode, preventing cross-service route leakage

  • Updated dependencies [012a8e410d09d9a5dcf060b30b4b24b08500823d, 9b8f974bbb64fb857b068428b0c2fdccee6ad83c, 96310842f34741ccced49eb9bd392631c2de4d14]:

    • @​vercel/build-utils@​13.3.5
    • @​vercel/python@​6.11.0

... (truncated)

Changelog

Sourced from vercel's changelog.

50.15.1

Patch Changes

50.15.0

Minor Changes

  • Add vercel flags command to manage feature flags from the CLI. This includes subcommands for listing, inspecting, creating, deleting, archiving, enabling, and disabling feature flags, as well as managing SDK keys for flag evaluation. (#14710)

    New commands:

    • vercel flags ls - List all feature flags
    • vercel flags inspect <flag> - Display detailed information about a feature flag, including its variants
    • vercel flags add <slug> - Create a new feature flag
    • vercel flags rm <flag> - Delete a feature flag (must be archived first)
    • vercel flags archive <flag> - Archive a feature flag
    • vercel flags disable <flag> - Disable a flag in an environment
    • vercel flags enable <flag> - Enable a flag in an environment
    • vercel flags sdk-keys ls - List SDK keys
    • vercel flags sdk-keys add - Create a new SDK key
    • vercel flags sdk-keys rm <key> - Delete an SDK key

  • Add --metadata / -m flag to vercel integration add for non-interactive provisioning (#14871)

  • Add vc link add subcommand to append projects to existing repo.json (#14968)

  • [services] detect and manage virtual environments for Python services (#14952)

  • Improved startup time 1.2-1.5x for CLI commands by implementing a different bundling & lazy loading strategy (#14930)

    Specifically, speedup the following subcommands: deploy, env, list, link, build, dev (informed by telemetry end-user usage data). The rest of the commands also became faster due to reduced amount of code they need to load.

Patch Changes

  • Add vercel integration discover with human-readable and JSON output for installable marketplace integrations and products. (#14948)

  • Add service configuration to BuildOptions (#14918)

  • [cli] integration add: auto-connect resources to all environments and auto-run env pull after provisioning. Add --no-connect and --no-env-pull opt-out flags. Print resource dashboard URL on success. (#14964)

  • Write repo.json "orgId" field on a per-project basis (#14967)

    • Fix services routing for runtime entrypoints by using extensionless function destinations, disabling framework defaultRoutes injection during services builds, and ensuring deterministic route merging precedence for services. (#14946)
    • Scope route-owning builder routes to their owning service prefixes in services mode, preventing cross-service route leakage

  • Updated dependencies [012a8e410d09d9a5dcf060b30b4b24b08500823d, 9b8f974bbb64fb857b068428b0c2fdccee6ad83c, 96310842f34741ccced49eb9bd392631c2de4d14]:

    • @​vercel/build-utils@​13.3.5

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump tar and vercel
004e00f 
Bumps [tar](https://github.com/isaacs/node-tar) and [vercel](https://github.com/vercel/vercel/tree/HEAD/packages/cli). These dependencies needed to be updated together.

Updates `tar` from 6.2.1 to 7.5.7
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.1...v7.5.7)

Updates `vercel` from 34.2.6 to 50.15.1
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/vercel@50.15.1/packages/cli)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.7
  dependency-type: indirect
- dependency-name: vercel
  dependency-version: 50.15.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants