Bump tar and @angular/cli in /core

[dependabot]

Bumps tar to 7.5.19 and updates ancestor dependency @angular/cli. These dependencies need to be updated together.

Updates tar from 7.5.10 to 7.5.19

Commits

• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• 21a8220 do not apply PAX header fields to meta entries
• 52632cf update project deps
• Additional commits viewable in compare view

Updates @angular/cli from 20.2.2 to 20.3.31

Release notes

Sourced from @​angular/cli's releases.

20.3.31

@​angular-devkit/build-angular

Commit	Description
	bump undici to 7.28.0

@​angular/build

Commit	Description
	bump vite to 7.3.6

20.3.30

@​angular/build

Commit	Description
	bump @​babel/core to 7.29.7
	bump esbuild to 0.28.1
	bump piscina to 5.2.0
	bump vite to 7.3.5

20.3.29

@​angular/cli

Commit	Description
	update pacote to 21.5.1

@​angular/ssr

Commit	Description
	prioritize options over environment variables in AngularNodeAppEngine

20.3.28

@​angular/cli

Commit	Description
	fallback to deprecated versions when resolving ranges if no non-deprecated version is found
	remove forceAuth and unscoped credential parsing

20.3.27

@​angular/ssr

Commit	Description
	add support for configuring trusted proxy headers via environment variable

20.3.26

@​angular/ssr

Commit	Description
	allow all hosts in common engine rendering options to prevent validation errors

20.3.25

@​angular-devkit/build-angular

... (truncated)

Changelog

Sourced from @​angular/cli's changelog.

20.3.31 (2026-07-01)

@​angular-devkit/build-angular

Commit	Type	Description
4ea787cd0	fix	bump undici to 7.28.0

@​angular/build

Commit	Type	Description
df5a2cc2b	fix	bump vite to 7.3.6

22.1.0-next.1 (2026-06-24)

@​angular/cli

Commit	Type	Description
48f90f5d5	fix	prevent Yarn registry environment variable override
38e0fabc0	fix	support registry metadata fetching under bun package manager
3ce6e5fc3	perf	implement semaphore backpressure throttling in PackageManager

@​schematics/angular

Commit	Type	Description
01008f1c6	fix	remove default workspace vscode mcp.json configuration

@​angular/build

Commit	Type	Description
851711b03	fix	aggregate parallel worker performance timings on the main thread
585d08af8	perf	default chunk optimization to use Rolldown
3019c8032	perf	dispose builder result context early in non-watch mode
583736a4d	perf	implement semaphore backpressure throttling in JavaScriptTransformer

@​angular/ssr

Commit	Type	Description
7ef9ed24d	feat	support the standard Forwarded header
37f1a7491	fix	avoid caching non-SSG page lookups
5875b6024	fix	prioritize options over environment variables in AngularNodeAppEngine

... (truncated)

Commits

• 85fe7ea release: cut the v20.3.31 release
• df5a2cc fix(@​angular/build): bump vite to 7.3.6
• 4ea787c fix(@​angular-devkit/build-angular): bump undici to 7.28.0
• 41d34b5 release: cut the v20.3.30 release
• 94fb3c1 fix(@​angular/build): bump piscina to 5.2.0
• 36adca9 fix(@​angular/build): bump @​babel/core to 7.29.7
• 7f236cf fix(@​angular/build): bump esbuild to 0.28.1
• 1f283a4 fix(@​angular/build): bump vite to 7.3.5
• a19c3a7 release: cut the v20.3.29 release
• b89b772 build: update dependency webpack-dev-server to 5.2.5
• Additional commits viewable in compare view