fix(deps): declare tar as explicit runtime dependency

[dipto0321]

Summary

nodeup-npm/scripts/install.js does const tar = require('tar') at module load time, but nodeup-npm/package.json had no dependencies block. The misleading comment claiming "npm bundles tar; no extra dep" was incorrect: npm uses tar internally, but it's not guaranteed to be reachable from an installed package's script context — yarn/pnpm do not hoist npm's internals, and npm's modern flat-install behavior is incidental.

Reproduced live: npm install in a clean dir with no dependencies, then node -e "require('tar')" returns Cannot find module 'tar'. yarn/pnpm users hit this on every non-Windows postinstall, completely locking them out of an install path that docs/installation.md lists as supported.

This PR declares tar as an explicit runtime dependency, pinned to ^6.2.1 to match the package's engines.node >= 14 floor (v7 requires Node 16+, a separate decision).

Linked issues

Closes #63

Type of change

• fix — bug fix (PATCH bump)
• feat — new feature (MINOR bump)
• refactor — no behavior change
• perf — performance improvement
• docs — documentation only
• test — tests only
• chore — maintenance / dependency bump
• ci — CI/CD only
• build — build system only
• Breaking change (MAJOR bump) — explain below

Checklist

• Title follows Conventional Commits (feat(scope): subject)
• I ran make ci locally and it passes (tidy/fmt/vet/lint/test all green)
• I added or updated tests for the change (verified via npm install + node -e "require('tar')" round-trip in a clean tmp dir; not adding a JS test framework for a single require check — see "Notes" below)
• I updated relevant docs (README, docs/, inline comments)
• No new linter warnings
• If breaking: I documented the migration path in the PR body and updated CHANGELOG.md

Screenshots / output

Pre-fix reproduction on a fresh npm install:

$ mkdir fresh-pkg && cd fresh-pkg
$ cat > package.json <<'EOF'
{ "name": "x", "version": "0.0.0" }
EOF
$ npm install
$ node -e "require('tar')"
node:internal/modules/cjs/loader:1224
  throw err;
  ^
Error: Cannot find module 'tar'
    at Function.Module._resolveFilename ...
    ...
code: 'MODULE_NOT_FOUND'

Post-fix verification (with "tar": "^6.2.1" in dependencies):

$ npm install
added 10 packages in 493ms
$ node -e "console.log('tar OK:', !!require('tar'))"
tar OK: true

Notes on testing

I deliberately did not introduce a JS test framework (jest, mocha, vitest, etc.) for what is ultimately a 1-line require-statement check — that would be a much larger change than the issue itself warrants, and it would add a Node-test-tooling-vs-version-pinning matrix to a project whose primary CI is go test. The behavior change is small enough that the round-trip above is the most useful test; a future PR adding a JS-side smoke workflow is the right place for a structured JS test suite.

The transitive npm audit warning that surfaces against unpinned tar@^6.x (the node-tar GHSA advisories referenced in #65 — path traversal / symlink poisoning / hardlink escape) is intentionally deferred. Bumping tar from v6 → v7 also raises engines.node from 14 → 16, which is a separate decision that belongs to #65.

Files touched

• nodeup-npm/package.json — adds:

  "dependencies": {
    "tar": "^6.2.1"
  }

  ^6.2.1 matches engines.node: ">=14" (v7 requires Node 16+).
• nodeup-npm/scripts/install.js —
  • Replaced the misleading // npm bundles tar; no extra dep comment with a 9-line explanation that names the failure mode (require fails at module-load time on yarn/pnpm), references bug(deps): nodeup-npm/install.js requires 'tar' with no declared dependency in package.json #63, and explains why tar is now a declared dependency.
  • Dropped the unused const zlib = require('zlib') import that the file was carrying (grep 'zlib\.' install.js had no matches — lint unused doesn't fire on .js files so it slipped through make lint).
• CHANGELOG.md — ### Fixed entry under [Unreleased] documenting the change with the bug(deps): nodeup-npm/install.js requires 'tar' with no declared dependency in package.json #63 reference and an explicit pointer that the v6→v7 / no-zip-slip side of this work is being deferred to bug(npm-wrapper): no zip-slip guard, Windows/ARM64 passes preinstall but 404s at download, partial state on failure #65.

[cocogitto-bot]

✔️ 7b4ef38 - Conventional commits check succeeded.