v0.2.0

Features

packTarSources

Added a new packTarSources archive helper in modern-tar/fs.

import { packTarSources, type TarSource } from 'modern-tar/fs';
import { createWriteStream } from 'node:fs';
import { pipeline } from 'node:stream/promises';

// Pack multiple sources
const sources: TarSource[] = [
  { type: 'file', source: './package.json', target: 'project/package.json' },
  { type: 'directory', source: './src', target: 'project/src' },
  { type: 'content', content: 'Hello World!', target: 'project/hello.txt' },
  { type: 'content', content: '#!/bin/bash\necho "Executable"', target: 'bin/script.sh', mode: 0o755 }
];

const archiveStream = packTarSources(sources);
await pipeline(archiveStream, createWriteStream('project.tar'));

This will make it easier to migrate away from older packages such as archiver.

---

PAX Support

Fully support PAX headers, meaning modern-tar now supports extracting .tar files larger than 8GB.

On an informal local benchmark (Macbook M3 Pro), an 8GB file had around ~450-500MB/s throughput when being extracted.

Bug Fixes

• The parser will error on truncated or incomplete .tar files.

• Prevent path traversal attacks when parsing certain files and hardlinks.

• Hugely increase the size of our test suite:

  • We use the same fixtures as tar-stream and tar-fs + some of our own.
  • We now test using some real world examples, such as the Lodash, Sharp, SWC or Electron NPM tar packages.
  • Node 20, 22, 24 and Bun is tested in a matrix on Linux, macOS and Windows.

What's Changed

• feat(fs): add archiver helpers by @ayuhito in #3
• test(ci): add a larger node matrix by @ayuhito in #5
• fix(fs): prevent path traversal for files and hardlinks by @ayuhito in #4
• fix(core): add proper incomplete tar handling by @ayuhito in #6
• test(core): match tar stream fixtures and more real world examples by @ayuhito in #7
• feat(pack): support pax headers fully by @ayuhito in #8

Full Changelog: v0.1.0...v0.2.0