chore: update dependencies (#1066)

There's a `tap@21` and a `tap-parser@18` but they don't support Node.js
18, so this only updates them to their previous major versions.

.github/workflows/close-stalled.yml

@@ -5,22 +5,22 @@ on:
 
 env:
   CLOSE_MESSAGE: >
-    Closing this because it has stalled. Feel free to reopen if this issue/PR
-    is still relevant, or to ping the collaborator who labelled it stalled if
-    you have any questions.
+    Closing this because it has stalled. Feel free to reopen if this issue/PR is
+    still relevant, or to ping the collaborator who labelled it stalled if you
+    have any questions.
 
 permissions:
   contents: read
 
 jobs:
   stale:
     permissions:
-      issues: write  # for actions/stale to close stale issues
-      pull-requests: write  # for actions/stale to close stale PRs
+      issues: write # for actions/stale to close stale issues
+      pull-requests: write # for actions/stale to close stale PRs
     if: github.repository == 'nodejs/citgm'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e  # v9.0.0
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-close: 30

lib/unpack.js

@@ -4,7 +4,7 @@ import { promisify } from 'util';
 import { createGunzip } from 'zlib';
 import { pipeline } from 'stream/promises';
 
-import tar from 'tar';
+import { extract } from 'tar';
 
 const existsPromise = promisify(exists);
 
@@ -24,7 +24,7 @@ export async function unpack(context) {
     );
     const inp = createReadStream(context.unpack);
     const gzip = createGunzip();
-    const out = tar.extract({
+    const out = extract({
       cwd: extractPath,
       strip: 1
     });

package.json

@@ -35,40 +35,40 @@
   "license": "MIT",
   "dependencies": {
     "async": "^3.2.5",
-    "bl": "^6.0.10",
+    "bl": "^6.0.14",
     "chalk": "^5.3.0",
     "columnify": "^1.6.0",
-    "execa": "^8.0.1",
+    "execa": "^9.3.0",
     "lodash": "^4.17.21",
     "normalize-git-url": "^3.0.2",
-    "npm-package-arg": "^11.0.1",
+    "npm-package-arg": "^11.0.2",
     "npm-which": "^3.0.1",
-    "pnpm": "^8.14.0",
+    "pnpm": "^9.5.0",
     "read-package-json": "^7.0.0",
     "root-check": "^2.0.0",
-    "semver": "^7.5.4",
+    "semver": "^7.6.3",
     "strip-ansi": "^7.1.0",
     "supports-color": "^9.4.0",
-    "tar": "^6.2.0",
+    "tar": "^7.4.0",
     "uid-number": "0.0.6",
-    "undici": "^6.3.0",
+    "undici": "^6.19.2",
     "which": "^4.0.0",
-    "winston": "^3.11.0",
-    "xml-sanitizer": "^2.0.0",
+    "winston": "^3.13.1",
+    "xml-sanitizer": "^2.0.1",
     "xmlbuilder": "^15.1.1",
     "yargs": "^17.7.2",
-    "yarn": "^1.22.21"
+    "yarn": "^1.22.22"
   },
   "devDependencies": {
-    "@eslint/js": "^9.6.0",
+    "@eslint/js": "^9.7.0",
     "ansi-regex": "^6.0.1",
-    "eslint": "^9.6.0",
+    "eslint": "^9.7.0",
     "eslint-config-prettier": "^9.1.0",
     "globals": "^15.8.0",
-    "prettier": "^3.3.2",
+    "prettier": "^3.3.3",
     "string-to-stream": "^3.0.1",
-    "tap": "^18.6.1",
-    "tap-parser": "^15.3.1",
+    "tap": "^20.0.3",
+    "tap-parser": "^17.0.0",
     "xml2js": "^0.6.2"
   },
   "prettier": {

test/test-grab-project.js

@@ -143,7 +143,7 @@ test('grab-project: fail with bad ref', async (t) => {
   } catch (err) {
     t.match(
       err.message,
-      /^Command failed\b.+\bgit fetch --depth=1 origin bad-git-ref/
+      /^Command failed\b.+\bgit fetch ['"]--depth=1['"] origin bad-git-ref/
     );
   }
 });