Summary

• Upgrade tar from 6.1.13 to 7.5.7 to address multiple security vulnerabilities
• Remove @types/tar devDependency since tar 7.x includes built-in TypeScript types
• Update import style from default import to namespace import (import * as tar from "tar") to work with tar 7.x's ESM/CJS hybrid exports

Security fixes

This upgrade addresses the following vulnerabilities:

• TURBO-5144: Arbitrary File Overwrite and Symlink Poisoning (patch: >=7.5.3)
• TURBO-5145: Race Condition via Unicode Ligature Collisions (patch: >=7.5.4)
• TURBO-5146: Hardlink Path Traversal (patch: >=7.5.7)
• TURBO-5150: DoS via folders count validation (patch: >=6.2.1)

Testing

• All existing tests pass
• Build succeeds
• The e2e test produces an installable npm package as before