Update package.json

[blubskye]

Fixes a circular dependency error, and a security vulnerability having to do with tar.

[samuelms1]

How does this fix the tar vulnerability? I'm not saying it doesn't, but it isn't obvious to me. I can see that [email protected] => [email protected] => [email protected]

I see this MR updates node-addon-api which I guess updates node-gyp?

[blubskye]

Because the older node version is what was causing the issue. You can try compiling it yourself, and then the audit command actually works. When before it didn't work. It wanted to downgrade the sqlite version for some reason.

[samuelms1]

I cloned the repo, used node v12.22.6, ran npm i, then ran npm ls, and checked the versions of tar. It was using [email protected] (not [email protected] which has the security vulnerability in [email protected]).

I think the tar security issue was resolved with #1441. The [email protected] was build in Feb and the fix was in March. I think it just needs to be republished with a new version.

[kewde]

Thanks eb7708a

[blubskye]

Yet the person did the same commit that I did, beautiful. At least it's fixed now.