Skip to content

Bump tar, yeoman-generator and lerna - #554

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-b984b5b47c
Open

Bump tar, yeoman-generator and lerna#554
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-b984b5b47c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps tar to 7.5.22 and updates ancestor dependencies tar, yeoman-generator and lerna. These dependencies need to be updated together.

Updates tar from 6.1.11 to 7.5.22

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

v6.1.12

6.1.12 (2022-10-31)

Bug Fixes

Documentation

Changelog

Sourced from tar's changelog.

Changelog

7.5

  • Added zstd compression support.
  • Consistent TOCTOU behavior in sync t.list
  • Only read from ustar block if not specified in Pax
  • Fix sync tar.list when file size reduces while reading
  • Sanitize absolute linkpaths properly
  • Prevent writing hardlink entries to the archive ahead of their file target

7.4

  • Deprecate onentry in favor of onReadEntry for clarity.

7.3

  • Add onWriteEntry option

7.2

  • DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

  • Update minipass to v7.1.0
  • Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

  • Drop support for node <18
  • Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
  • Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
  • Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
  • Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates yeoman-generator from 5.10.0 to 8.3.0

Release notes

Sourced from yeoman-generator's releases.

v8.3.0

8.3.0 (2026-08-24)

Features

  • optionally use meta.getPackageJson for rootGeneratorName and rootGeneratorVersion (#1834) (ca58b19)

v8.2.2

8.2.2 (2026-04-29)

Bug Fixes

  • try to avoid could be instantiated with a different subtype of constraint issue (#1798) (2a83721)

v8.2.1

8.2.1 (2026-04-28)

Bug Fixes

  • add return type to avoid complex type generation (#1795) (ddb534c)

v8.2.0

8.2.0 (2026-04-28)

Features

Bug Fixes

v8.1.2

  • fix: update proxy behavior to handle raw values and add related tests (#1762) 0f4dc08
  • feat: add StorageTransform type and update StorageOptions (#1761) 1684d01

yeoman/generator@v8.1.1...v8.1.2

v8.1.1

  • fix: types adjusts (#1760) d02af1d

... (truncated)

Changelog

Sourced from yeoman-generator's changelog.

8.3.0 (2026-08-24)

Features

  • optionally use meta.getPackageJson for rootGeneratorName and rootGeneratorVersion (#1834) (ca58b19)

8.2.2 (2026-04-29)

Bug Fixes

  • try to avoid could be instantiated with a different subtype of constraint issue (#1798) (2a83721)

8.2.1 (2026-04-28)

Bug Fixes

  • add return type to avoid complex type generation (#1795) (ddb534c)

8.2.0 (2026-04-28)

Features

Bug Fixes

Commits
  • 7bd584d chore(main): release 8.3.0 (#1835)
  • ca58b19 feat: optionally use meta.getPackageJson for rootGeneratorName and rootGenera...
  • f1dba85 chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1833)
  • cbf3e29 chore(deps): bump the codeql-action group with 4 updates (#1832)
  • 6ffd690 chore: add codeql group to dependabot (#1831)
  • 523852e chore(deps): bump github/codeql-action/upload-sarif (#1828)
  • 721ed3d chore(deps): bump actions/stale from 10.4.0 to 11.0.0 (#1826)
  • 75f6bef chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0 (#1816)
  • dd88aa8 chore(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.0 (#1817)
  • 2e3512c chore(deps): bump actions/stale from 10.3.0 to 10.4.0 (#1818)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for yeoman-generator since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates lerna from 7.4.2 to 10.0.1

Release notes

Sourced from lerna's releases.

v10.0.1

10.0.1 (2026-08-19)

Bug Fixes

  • missing peer dependency in lerna 10 (#4412) (06b8acb)
  • skip unnecessary package managers during release (#4413) (ed46de5)

v10.0.0

10.0.0 (2026-07-29)

  • feat!: throw error in case of stale remote for CI mode (#4369) (3e81682), closes #4369
  • feat!: support node ^22.13.0 || ^24.0.0 || ^26.0.0, ship lerna as ESM-only (#4390) (a148ba2), closes #4390
  • fix(core)!: replace deprecated conventional-changelog dependencies (#4332) (b1ff72f), closes #4332

Bug Fixes

  • core: remove p-map-series, p-pipe, p-reduce, and p-waterfall (#4321) (fe066cb)
  • core: remove upath dependency (#4317) (aa65470)
  • core: support changelog presets that only expose the ESM import condition (#4385) (294e33a)
  • core: support OIDC trusted publishing on CircleCI (#4383) (a0963b9)
  • publish: show output from publish and postpublish lifecycle scripts (#4330) (9e87a34)

Features

  • core: add bun as supported package manager (#4264) (4ca7d2c)

BREAKING CHANGES

  • In CI, EBEHIND will now be thrown during versioning and publishing if the checkout is behind the latest on the remote. This previously only occurred outside of CI environments.

    If you wish to opt into the old behavior, you can do so by setting --ci-behind-behavior (error | skip, default error) or command.version.ciBehindBehavior in lerna.json.

  • Lerna is now shipped as ESM-only and the lowest supported node version has changed to 22.13.0, because on this version CommonJS consumers can still require in its entry points without any additional flags or warnings.

  • Lerna now uses the current conventional-changelog APIs instead of the deprecated conventional-changelog-core stack.

    Generated CHANGELOG.md output may differ, including normalized whitespace and URL-encoded tag names. Projects using custom changelog presets should verify their output; Lerna retains compatibility for legacy parser/writer option names and Handlebars string templates.

    CLI options and version-bump behavior remain unchanged.

v9.0.7

9.0.7 (2026-03-13)

Bug Fixes

  • core: normalize ./ prefix in workspace globs for package detection (#4308) (bd39779)
  • core: remove multimatch dependency and legacy-core internals (#4314) (ec01462)
  • version: skip config resolution in prettier getFileInfo check (#4306) (ae53efe)
  • version: support ESM and new v8+ conventional-changelog preset API (#4302) (575b248)

... (truncated)

Changelog

Sourced from lerna's changelog.

10.0.1 (2026-08-19)

Bug Fixes

10.0.0 (2026-07-29)

  • feat!: throw error in case of stale remote for CI mode (#4369) (3e81682), closes #4369
  • feat!: support node ^22.13.0 || ^24.0.0 || ^26.0.0, ship lerna as ESM-only (#4390) (a148ba2), closes #4390
  • fix(core)!: replace deprecated conventional-changelog dependencies (#4332) (b1ff72f), closes #4332

Bug Fixes

  • core: remove p-map-series, p-pipe, p-reduce, and p-waterfall (#4321) (fe066cb)
  • core: remove upath dependency (#4317) (aa65470)

Features

  • core: add bun as supported package manager (#4264) (4ca7d2c)

BREAKING CHANGES

  • In CI, EBEHIND will now be thrown during versioning and publishing if the checkout is behind the latest on the remote. This previously only occurred outside of CI environments.

    If you wish to opt into the old behavior, you can do so by setting --ci-behind-behavior (error | skip, default error) or command.version.ciBehindBehavior in lerna.json.

  • Lerna is now shipped as ESM-only and the lowest supported node version has changed to 22.13.0, because on this version CommonJS consumers can still require in its entry points without any additional flags or warnings.

  • Lerna now uses the current conventional-changelog APIs instead of the deprecated conventional-changelog-core stack.

    Generated CHANGELOG.md output may differ, including normalized whitespace and URL-encoded tag names. Projects using custom changelog presets should verify their output; Lerna retains compatibility for legacy parser/writer option names and Handlebars string templates.

    CLI options and version-bump behavior remain unchanged.

9.0.7 (2026-03-13)

Bug Fixes

  • core: remove multimatch dependency and legacy-core internals (#4314) (ec01462)

9.0.6 (2026-03-11)

Bug Fixes

9.0.5 (2026-02-28)

Bug Fixes

... (truncated)

Commits
  • 35d15a1 chore(misc): publish 10.0.1
  • 06b8acb fix: missing peer dependency in lerna 10 (#4412)
  • e50e1a9 chore(deps): bump tar to 7.5.22 (#4406)
  • 5f43163 chore(misc): publish 10.0.0
  • 138260c chore: nx 23.1 floor instead of 23.0 (#4403)
  • 14bb535 chore(deps): bump js-yaml to 4.3.0 and tar to 7.5.20 (#4397)
  • 3e81682 feat!: throw error in case of stale remote for CI mode (#4369)
  • a148ba2 feat!: support node ^22.13.0 || ^24.0.0 || ^26.0.0, ship lerna as ESM-only (#...
  • b1ff72f fix(core)!: replace deprecated conventional-changelog dependencies (#4332)
  • 1f7e109 chore(repo): migrate from jest to vitest (#4389)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lerna since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
@gfontorbe

gfontorbe commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b984b5b47c branch from 97e0fa4 to a479cbb Compare August 24, 2026 09:16
@dependabot
Bump tar, yeoman-generator and lerna
8ab4dce 
Bumps [tar](https://github.com/isaacs/node-tar) to 7.5.22 and updates ancestor dependencies [tar](https://github.com/isaacs/node-tar), [yeoman-generator](https://github.com/yeoman/generator) and [lerna](https://github.com/lerna/lerna/tree/HEAD/packages/lerna). These dependencies need to be updated together.


Updates `tar` from 6.1.11 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.1.11...v7.5.22)

Updates `yeoman-generator` from 5.10.0 to 8.3.0
- [Release notes](https://github.com/yeoman/generator/releases)
- [Changelog](https://github.com/yeoman/generator/blob/main/CHANGELOG.md)
- [Commits](yeoman/generator@v5.10.0...v8.3.0)

Updates `lerna` from 7.4.2 to 10.0.1
- [Release notes](https://github.com/lerna/lerna/releases)
- [Changelog](https://github.com/lerna/lerna/blob/main/packages/lerna/CHANGELOG.md)
- [Commits](https://github.com/lerna/lerna/commits/v10.0.1/packages/lerna)

---
updated-dependencies:
- dependency-name: lerna
  dependency-version: 10.0.1
  dependency-type: direct:development
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
- dependency-name: yeoman-generator
  dependency-version: 8.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b984b5b47c branch from a479cbb to 8ab4dce Compare August 24, 2026 09:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gfontorbe