Bump tar and npm-check-updates

[dependabot]

Removes tar. It's no longer used after updating ancestor dependency npm-check-updates. These dependencies need to be updated together.

Removes tar

Updates npm-check-updates from 16.7.12 to 23.0.1

Release notes

Sourced from npm-check-updates's releases.

v23.0.1

What's Changed

• Pin Docker base image by digest by @​XhmikosR in raineorshine/npm-check-updates#1947
• build(deps): bump the github-actions group with 4 updates by @​dependabot[bot] in raineorshine/npm-check-updates#1950
• Add zizmor workflow by @​XhmikosR in raineorshine/npm-check-updates#1946
• Update LICENSE by @​XhmikosR in raineorshine/npm-check-updates#1952
• Delete the unused .github/screenshot.png by @​XhmikosR in raineorshine/npm-check-updates#1953
• Replace timeago.js with the native Intl.RelativeTimeFormat by @​XhmikosR in raineorshine/npm-check-updates#1936
• Doc fixes by @​XhmikosR in raineorshine/npm-check-updates#1955
• Update dependencies by @​XhmikosR in raineorshine/npm-check-updates#1954
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in raineorshine/npm-check-updates#1965
• Replace libnpmconfig and figgy-pudding with an in-house npm config loader by @​XhmikosR in raineorshine/npm-check-updates#1934

Full Changelog: raineorshine/npm-check-updates@v23.0.0...v23.0.1

v23.0.0

⚠️ Breaking changes & migration

1. Node.js 22+ required (#1844) The minimum supported Node.js is now 22. Supported versions: ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10).

• Migration: Upgrade Node before installing. On older Node, stay on v22.x.

2. Pure ESM package — CJS build dropped, default export is now callable (#1916, #1894) The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. ncu.run() and ncu.defineConfig() still work as namespaced properties.

• Migration (ESM):

  // before
  import * as ncu from 'npm-check-updates'
  const upgraded = await ncu.run({ /* ... */ })
  // after
  import ncu from 'npm-check-updates'
  const upgraded = await ncu({ /* ... */ }) // ncu.run({...}) also still works

• Migration (CommonJS): Still usable via Node's native require() of ESM (Node 22+), but the import shape changed:

  // before
  const ncu = require('npm-check-updates')
  // after
  const { default: ncu } = require('npm-check-updates')
  ncu({ /* ... */ }).then(upgraded => console.log(upgraded))

3. filterVersion / rejectVersion no longer accept a predicate function. Use filter / reject instead. (#1933) These options now accept only a string, wildcard, glob, comma/space-delimited list, or /regex/. (CLI usage is unchanged — the CLI never supported functions.)

• Migration: If you passed a function to filterVersion/rejectVersion in .ncurc.js or via the module API, move it to filter / reject instead. Those receive the package name and the parsed current version, so they can match on both:

  // before
  filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
  // after

... (truncated)

Commits

• 16594d9 23.0.1
• 619e136 Replace libnpmconfig and figgy-pudding with an in-house npm config loader (#1...
• 4b6574a build(deps): bump the github-actions group with 3 updates (#1965)
• f3ae9d3 Update dependencies (#1954)
• 15fcef7 Doc fixes (#1955)
• b37432f Replace timeago.js with the native Intl.RelativeTimeFormat (#1936)
• f2055b0 Delete the unused .github/screenshot.png (#1953)
• 87758d8 Update LICENSE (#1952)
• b70e3c3 Add zizmor workflow (#1946)
• 1179fb3 build(deps): bump the github-actions group with 4 updates (#1950)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Dependabot can't parse your package-lock.json. Because of this, Dependabot cannot update this pull request.