chore(deps): bump tar from 7.5.21 to 7.5.22

[dependabot]

Bumps tar from 7.5.21 to 7.5.22.

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• See full diff in compare view

[cursor]

PR Summary

Low Risk
Routine dependency patch with lockfile churn; tar is used for package tarball handling but behavior change is limited to upstream 7.5.22 (e.g. allowing a falsey transform).

Overview
Bumps the direct tar dependency in @crowd/packages-worker from 7.5.21 to 7.5.22 (used for npm tarball extraction in blast-radius). pnpm-lock.yaml is refreshed so the resolved tar version and a set of transitive dependency pins align with the new tree (e.g. MCP/Hono stack, Express 5-related packages, AWS SDK client peer wiring, Clearbit needle git resolution).

This is a patch-level library update with no application source changes beyond the version specifier.

^{Reviewed by Cursor Bugbot for commit 3b9517e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f051a3d. Configure here.}

[cursor]

Needle resolved via SSH git

High Severity

clearbit's needle dependency was rewritten from an HTTPS codeload.github.com tarball to a type: git resolution with repo: [email protected]:clearbit/needle.git. Fresh installs and CI using pnpm i --frozen-lockfile without GitHub SSH credentials can fail when fetching that package.

Additional Locations (2)

• pnpm-lock.yaml#L15675-L15676
• pnpm-lock.yaml#L18534-L18535

 

^{Reviewed by Cursor Bugbot for commit f051a3d. Configure here.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.