build(deps): bump tar from 7.5.16 to 7.5.22 in the npm_and_yarn group across 1 directory - #58

Hold this one — the bump is legitimate but the PR does two things the title doesn't say.

1. Only one line of the 432 is the tar bump

$ git diff main HEAD -- yarn.lock | grep -E '^[+-]  resolution:'
-  resolution: "tar@npm:7.5.16"
+  resolution: "tar@npm:7.5.22"

The rest is a lockfile dialect downgrade — __metadata.version 10 → 6, cacheKey 10c0 → 8, every checksum rewritten from 10c0/169fc208… to bare 169fc208…. Dependabot regenerated the file with an older Yarn than the one that produced main's lockfile.

2. The lockfile is decorative — release CI runs Yarn 1.22.22 against a Berry lockfile

From the last release run (30111489505):

! Corepack is about to download .../yarn-1.22.22.tgz
yarn install v1.22.22
[1/4] Resolving packages...
success Saved lockfile.

success Saved lockfile. on an --immutable install is the tell: --immutable is a Berry flag, Yarn 1's equivalent is --frozen-lockfile, and Yarn 1 ignores the unknown flag. It also can't parse a Berry lockfile, so it floats every ^ range in package.json fresh from the registry — in a job holding GITHUB_TOKEN (push) and PyPI OIDC publishing rights.

Root cause: no packageManager field in package.json, so corepack enable falls back to its default Yarn 1.22.22. .yarnrc.yml (nodeLinker: node-modules) is Berry-only config that Yarn 1 also ignores.

So this PR's tar pin has no effect on what the release job actually installs.

Scope

tar is transitive dev-only tooling — pyproject.toml excludes package.json/yarn.lock/node_modules from the sdist and the wheel target is packages = ["src/convert_sdk"], so there's no published-package exposure. (5 advisories affect 7.5.16 incl. one critical, GHSA-23hp-3jrh-7fpw — worth fixing, not user-facing.) Note the 21 green checks don't cover this: ci.yml is Python-only, no yarn step.

Suggested order

1. corepack use yarn@4 to write packageManager, and verify yarn install --immutable round-trips main's lockfile unchanged.
2. Then @dependabot recreate — the tar bump should be a ~4-line diff.
3. Add a yarn install --immutable job to ci.yml so dialect drift fails a PR instead of passing silently.

Step 1 is worth its own PR regardless — it's a strictly larger hole than the action pinning in #57.

closed in favor of PR #59

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml