[khaliqgant]

Summary

• Upgrade the CLI and registry to tar 7.5.22 to address the advisories shown during global CLI installation.
• Upgrade registry bcrypt to 6.0.0, removing its transitive tar 6 dependency.
• Align the CLI Node requirement, build target, and installation guide at Node 18+.
• Verify that bcrypt 6 accepts a password hash generated with bcrypt 5.1.1.

Verification

• npm ls tar --all resolves only tar 7.5.22.
• Production npm audit reports no tar finding.
• CLI typecheck and build pass; 56 focused archive/install/show tests pass.
• Registry typecheck and build pass; package route tests pass (11 passed, 4 skipped); bcrypt compatibility test passes.
• Veto diff review passes on all 6 changed files with no security or secrets findings.

The registry auth test file currently has 14 failing assertions against its route contract (for example, it expects a 201 registration response while the route returns 200, and sends identifier while the route requires email). Those files are unchanged in this PR.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	02e0257	Oct 14, 2026 · 17:10	17:12

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt PR Risk: Low Risk

• The PR appears safe to merge; it aligns the CLI's documented and configured minimum Node.js version with the updated dependency requirements.
• The bcrypt upgrade includes a test confirming that existing password hashes remain verifiable.

Assessed commit: 542da7d8e91b

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 6 files

_{View guided diff | Re-trigger cubic}

[khaliqgant]

CI note: The Registry Tests and E2E Registry Tests jobs fail in their Start MinIO step. Docker Hub returns pull access denied for minio/minio:latest, so neither job reaches typecheck or tests. The CLI, security, other package checks, and the CLI publish dry run pass. This image availability issue is separate from the dependency changes in this PR.