Bump tar-stream from 3.2.0 to 3.2.1 in the prod-dependencies group across 1 directory

[dependabot]

Bumps the prod-dependencies group with 1 update in the / directory: tar-stream.

Updates tar-stream from 3.2.0 to 3.2.1

Commits

• 246572f 3.2.1
• 5aa24f7 Add TypeScript typings (#179)
• See full diff in compare view

[jeffwidman]

Status: blocked on the upstream fix

We opened mafintosh/tar-stream#184 to correct the published streamx dependency range. This Dependabot update is blocked on that PR landing and a new tar-stream patch release being published. Once that release is available, Dependabot can refresh or recreate this update with consistent dependency metadata.

Why CI is failing

Both failing checks have the same TypeScript declaration-resolution root cause; this does not currently look like a tar-stream runtime regression.

tar-stream@3.2.1 added first-party TypeScript declarations in mafintosh/tar-stream#179. Those declarations import Readable, Writable, and related types from streamx.

This PR leaves the transitive dependency locked at streamx@2.23.0. Streamx did not publish TypeScript declarations until 2.28.0, so the first compiler failure is:

node_modules/tar-stream/index.d.ts(7,8): error TS7016:
Could not find a declaration file for module "streamx".

The remaining errors are consequences of that missing declaration: Pack is not recognized as a readable stream, Extract appears not to have .on(), event callback arguments become implicit any, and the extractor is not assignable to a writable stream. The test job hits these during npm run typecheck; the integration job hits the same errors while compiling the test suites.

Tar-stream still declares streamx: ^2.15.0, so 2.23.0 satisfies its published dependency range and the package manager has no reason to refresh the existing transitive lock entry. This mismatch is tracked in mafintosh/tar-stream#183, with the fix proposed in mafintosh/tar-stream#184.

We could work around the problem here by refreshing the transitive lock entry to streamx >= 2.28.1, for example with:

npm update streamx --package-lock-only

That would supply both the declarations and Node core stream type compatibility expected by tar-stream 3.2.1. However, the cleaner and simpler option is to wait for the upstream patch release rather than carrying a transitive lockfile workaround here.

Recommendation: treat this PR as blocked on mafintosh/tar-stream#184 landing and being released, then let Dependabot refresh or recreate the update normally.