@vercel/fun pins a deprecated, vulnerable tar@7.5.7 (still in latest 1.3.1) — please loosen to ^7.5.19

Summary

@vercel/fun hard-pins an exact, deprecated version of tar, and the pin is still present in the latest release (1.3.1). Because it's an exact pin (no range), downstream consumers — including the vercel CLI — can't pick up the fixed tar transitively even after updating everything.

Where

@vercel/fun@1.3.1 (and 1.3.0) package.json:

"dependencies": {
  "tar": "7.5.7"
}

Why it matters

tar@7.5.7 is deprecated on npm — the maintainer's notice reads: "Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version." The current release is 7.5.19.

Recent node-tar advisories in the 7.x line (2025–2026) include, among others:

• GHSA-r6q2-hw4h-h46w — race condition on macOS APFS (High, 8.8)
• GHSA-9ppj-qmqm-q256 — symlink path traversal (High, 8.2)
• GHSA-qffp-2rhf-9h96 — hardlink path traversal (High, 8.2)
• GHSA-34x7-hfp2-rc4v — arbitrary file create/overwrite (High, 8.2)
• GHSA-8qq5-rm4j-mr97 — file overwrite / symlink poisoning (High, 8.2)

Because the pin is exact, this can't be resolved downstream:

vercel@54.18.7
└─ @vercel/fun@1.3.0
   └─ tar@7.5.7

npm ls -g tar stays on 7.5.7 even after npm install -g npm@latest (which correctly moves npm's own copy to 7.5.19) and reinstalling the vercel CLI.

Suggested fix

Loosen the pin so patched releases resolve automatically:

"tar": "^7.5.19"

(or at minimum ^7.4.0, matching what @mapbox/node-pre-gyp in the same dependency tree already uses.)

Environment

• @vercel/fun 1.3.0 / 1.3.1 (latest)
• pulled in via the vercel CLI 54.18.7
• npm 11.18.0, Node 24.14.0, macOS

Start with the package.json dependency declaration for @vercel/fun@1.3.1, where tar is pinned to 7.5.7. Change the range to the requested patched release range, then install the package and verify that tar resolves to a current 7.x version without breaking the dependency tree.