modern-tar is a zero-dependency, cross-platform JavaScript library designed for efficient streaming of tar archives. It supports both parsing and writing tar files, leveraging the browser-native Web Streams API for optimal performance and memory efficiency across diverse JavaScript runtimes, including Node.js (requiring version 18.0.0 or higher), web browsers, and Cloudflare Workers. The library is currently at stable version 0.7.6, with a consistent release cadence that introduces bug fixes, performance optimizations, and crucial security patches. Its key differentiators include a robust streaming architecture capable of handling large archives without full memory loading, full compliance with USTAR format and PAX extensions, built-in helpers for gzip compression, a TypeScript-first design ensuring strong type safety, and a minimal footprint due to its zero external dependencies.
npm install modern-tarVerified import paths — ran on the pinned version, not inferred.
Demonstrates streaming tar creation with `createTarPacker` and subsequent decoding with `createTarDecoder`, highlighting dynamic entry addition and the necessity of draining entry bodies.
Remove the `streamTimeout` option from your `UnpackOptions` configuration.
Update your code to explicitly check for `undefined` when accessing the `data` property for entries, especially for non-file types.
Upgrade to version 0.7.4 or later to mitigate the prototype pollution vulnerability.
Upgrade to version 0.7.6 or later to ensure correct and secure handling of tar archives, particularly those with large headers or complex unicode paths.
After processing an `entry.body` (or if you choose to skip it), ensure you call `await entry.body.cancel()` or fully read its content (e.g., `await new Response(entry.body).arrayBuffer()`) before attempting to retrieve the next entry.
Change your import statement from `const { packTar } = require('modern-tar')` to `import { packTar } from 'modern-tar'`.Ensure that after processing each entry, you either fully consume its `entry.body` stream or explicitly call `await entry.body.cancel()` to signal that you are done with it and allow the decoder to proceed.
No dependency data recorded yet.