`tar` is capped at `^6.0.1`, resolving to the deprecated 6.2.1 with 12 unfixed advisories

**Description:**

`packages/@ionic/cli/package.json` declares `"tar": "^6.0.1"`. There have been no 6.x releases since, and the tar maintainer has formally deprecated the entire 6.x line. `npm install @ionic/cli` prints:

```
npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain
widely publicized security vulnerabilities, which have been fixed in the current
version. Please update.
```

All 12 currently-open advisories against 6.2.1 are fixed only in 7.x, so `npm audit` reports `No fix available`/

This is not a theoretical exposure. `ionic start` downloads a remote tarball from `STARTER_BASE_URL` (`https://d2ql0qc7j8u4b2.cloudfront.net`) and pipes it straight into `tar.extract({ cwd: projectDir })` (`src/commands/start.ts:1131`); the Cordova integration does the same into a temp dir (`src/lib/integrations/cordova/index.ts:68`). Several of the unfixed advisories are precisely arbitrary-file-write-on-extract bugs — hardlink and symlink path traversal — which is the exact operation the CLI performs on downloaded archives.

Highest-severity items still affecting 6.2.1:

| Advisory | CVE | Severity | Fixed in |
| --- | --- | --- | --- |
| [GHSA-23hp-3jrh-7fpw](https://github.com/advisories/GHSA-23hp-3jrh-7fpw) | CVE-2026-59873 | Critical | 7.5.19 |
| [GHSA-34x7-hfp2-rc4v](https://github.com/advisories/GHSA-34x7-hfp2-rc4v) | CVE-2026-24842 | High | 7.5.7 |
| [GHSA-83g3-92jg-28cx](https://github.com/advisories/GHSA-83g3-92jg-28cx) | CVE-2026-26960 | High | 7.5.8 |
| [GHSA-8qq5-rm4j-mr97](https://github.com/advisories/GHSA-8qq5-rm4j-mr97) | CVE-2026-23745 | High | 7.5.3 |
| [GHSA-qffp-2rhf-9h96](https://github.com/advisories/GHSA-qffp-2rhf-9h96) | CVE-2026-29786 | High | 7.5.10 |
| [GHSA-9ppj-qmqm-q256](https://github.com/advisories/GHSA-9ppj-qmqm-q256) | CVE-2026-31802 | High | 7.5.11 |
| [GHSA-r6q2-hw4h-h46w](https://github.com/advisories/GHSA-r6q2-hw4h-h46w) | CVE-2026-23950 | High | 7.5.4 |
| [GHSA-8x88-c5mf-7j5w](https://github.com/advisories/GHSA-8x88-c5mf-7j5w) | CVE-2026-59874 | High | 7.5.18 |

Plus four moderate DoS/parser-differential advisories (GHSA-vmf3-w455-68vh, GHSA-w8wr-v893-vjvp, GHSA-gvwx-54wh-qm9j, GHSA-r292-9mhp-454m), all likewise 7.x-only fixes.

The last time this dependency moved was #4300 (Dependabot, tar 5.0.5 → 6.0.1) in January 2020.

**Steps to Reproduce:**

```sh
mkdir tar-repro && cd tar-repro
npm init -y
npm install @ionic/cli@7.2.1
npm ls tar
npm audit
```

`npm ls tar` shows `tar@6.2.1`. `npm audit` reports the tar advisories as critical with no available fix.

**Output:**

Install-time deprecation warning:

```
npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

added 208 packages in 5s
```

Resolved version:

```
$ npm ls tar --all
└── tar@6.2.1
```

`npm audit` (trimmed to the tar entry):

```
# npm audit report

tar <=7.5.20
Severity: critical
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - https://github.com/advisories/GHSA-34x7-hfp2-rc4v
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction - https://github.com/advisories/GHSA-83g3-92jg-28cx
tar has Hardlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-qffp-2rhf-9h96
node-tar Symlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-9ppj-qmqm-q256
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) - https://github.com/advisories/GHSA-vmf3-w455-68vh
node-tar: Process crash via PAX numeric path type confusion - https://github.com/advisories/GHSA-w8wr-v893-vjvp
node-tar: Decompression/parse DoS via unlimited input - https://github.com/advisories/GHSA-23hp-3jrh-7fpw
node-tar: Negative tar entry size causes infinite loop in archive replace - https://github.com/advisories/GHSA-8x88-c5mf-7j5w
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records - https://github.com/advisories/GHSA-gvwx-54wh-qm9j
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection - https://github.com/advisories/GHSA-r292-9mhp-454m
No fix available
node_modules/tar
@ionic/cli *
Depends on vulnerable versions of @ionic/cli-framework-prompts
Depends on vulnerable versions of tar
node_modules/@ionic/cli
```

**My `ionic info`:**

```
Ionic:

Ionic CLI : 7.2.1

Utility:

cordova-res : not installed globally
native-run : not installed globally

System:

NodeJS : v22.21.0
npm : 10.9.4
OS : macOS Unknown
```

**Other Information:**

Suggested fix: bump to `"tar": "^7.5.22"` (or `^7`) in `packages/@ionic/cli/package.json`, with `@types/tar` dropped since tar 7 ships its own types.

Two things worth flagging for whoever picks this up:

1. **The API surface is small.** There are only two call sites, both reached through the `src/lib/utils/archive.ts` re-export shim, and both use the same call: `tar.extract({ cwd })` (`src/commands/start.ts:1131`, `src/lib/integrations/cordova/index.ts:68`). `tar.extract()` is still present in 7.x and still returns a writable stream when given no `file`/`entries`.

2. **`engines` needs to move too.** tar 7 declares `"node": ">=18"`, while `@ionic/cli` currently declares `"node": ">=16.0.0"`.

Dependabot is configured for daily npm updates (`.github/dependabot.yml`), but a major-version bump across the `^6` ceiling has not landed.

Start with packages/@ionic/cli/package.json and the shared archive re-export at src/lib/utils/archive.ts, then inspect the extraction call sites in src/commands/start.ts:1131 and src/lib/integrations/cordova/index.ts:68. Check tar 7 compatibility and the Node engine declaration, including whether @types/tar can be removed. Done means the dependency and engine constraints are updated, both extraction paths remain functional, and the reproduction no longer reports the vulnerable tar version.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.