fix(deps): bump nanotar 0.2.0 → 0.2.1 to patch CVE-2025-69874

[John-David Dalton (jdalton)]

Summary

Patches Dependabot alert #97 — nanotar ≤ 0.2.0 is vulnerable to path traversal in parseTar() / parseTarGzip() (GHSA-92fh-27vv-894w, CVE-2025-69874, medium severity).

Upstream shipped 0.2.1 as a backport patch minutes after releasing 0.3.0, so 0.2.1 keeps us on the 0.2.x line with only the path-sanitization fix applied (unjs/nanotar#58). Chose 0.2.1 over 0.3.0 to minimize unrelated changes; a later PR can bump to 0.3.0 once that's been exercised in other consumers.

Test plan

• pnpm-workspace.yaml catalog entry bumped.
• pnpm install regenerates pnpm-lock.yaml with nanotar@0.2.1 (no other dep churn).
• CI green on this PR.
• Dependabot alert pnpm alternative to safe-npm #97 auto-resolves after merge.

Note on sequencing

PR #1249 (fleet-wide pnpm rc.5 alignment) also touches pnpm-workspace.yaml. Whichever of the two merges first, the other will need a trivial rebase.

---

Note

Low Risk
Low risk dependency-only change; behavior impact is limited to nanotar tar parsing, though it could affect any code paths that extract archives.

Overview
Updates the workspace dependency catalog and lockfile to use nanotar@0.2.1 instead of 0.2.0, pulling in the upstream patch for the reported path traversal issue.

No application/source code changes; the diff is limited to pnpm-workspace.yaml and pnpm-lock.yaml version/resolution updates (including integrity hash refresh).

^{Reviewed by Cursor Bugbot for commit 34cc060. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​nanotar@​0.2.0 ⏵ 0.2.1	+1	+2	+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​nanotar@​0.2.0 ⏵ 0.2.1	+1	+2	+1	-3

View full report