diff --git a/package-lock.json b/package-lock.json
index 07720fa..358f3ea 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -28,7 +28,7 @@
 				"remult": "^2.7.33",
 				"semver": "^7.7.4",
 				"sqlite3": "^6.0.1",
-				"tar": "^7.5.16",
+				"tar": "^7.5.22",
 				"tough-cookie": "^6.0.0",
 				"tsx": "^4.19.3",
 				"typescript": "^5.8.3",
@@ -11748,9 +11748,9 @@
 			}
 		},
 		"node_modules/npm": {
-			"version": "10.9.8",
-			"resolved": "https://registry.npmjs.org/npm/-/npm-10.9.8.tgz",
-			"integrity": "sha512-fYwb6ODSmHkqrJQQaCxY3M2lPf/mpgC7ik0HSzzIwG5CGtabRp4bNqikatvCoT42b5INQSqudVH0R7yVmC9hVg==",
+			"version": "10.9.9",
+			"resolved": "https://registry.npmjs.org/npm/-/npm-10.9.9.tgz",
+			"integrity": "sha512-1g+6jLQvaIuB4zwvHL7yrXuXcWZwDsCtBX8bbWDqbvJSSr9nPiDDWTHNgwXR27iIcTTW7v3A57hDW9RYv2W4Yg==",
 			"bundleDependencies": [
 				"@isaacs/string-locale-compare",
 				"@npmcli/arborist",
@@ -11892,7 +11892,7 @@
 				"spdx-expression-parse": "^4.0.0",
 				"ssri": "^12.0.0",
 				"supports-color": "^9.4.0",
-				"tar": "^7.5.11",
+				"tar": "^7.5.22",
 				"text-table": "~0.2.0",
 				"tiny-relative-date": "^1.3.0",
 				"treeverse": "^3.0.0",
@@ -13991,7 +13991,7 @@
 			}
 		},
 		"node_modules/npm/node_modules/tar": {
-			"version": "7.5.11",
+			"version": "7.5.22",
 			"dev": true,
 			"inBundle": true,
 			"license": "BlueOak-1.0.0",
@@ -17292,9 +17292,9 @@
 			}
 		},
 		"node_modules/tar": {
-			"version": "7.5.16",
-			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-			"integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+			"version": "7.5.22",
+			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+			"integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
 				"@isaacs/fs-minipass": "^4.0.0",
diff --git a/package.json b/package.json
index 630ba5f..cd5597f 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
 		"remult": "^2.7.33",
 		"semver": "^7.7.4",
 		"sqlite3": "^6.0.1",
-		"tar": "^7.5.16",
+		"tar": "^7.5.22",
 		"tough-cookie": "^6.0.0",
 		"tsx": "^4.19.3",
 		"typescript": "^5.8.3",