Repository: kubernetes-client/javascript
Pull request #2402: Move to tar-fs.
Author: login: brendandburns
Labels: name: cncf-cla: yes
description: Indicates the PR's author has signed the CNCF CLA.
name: size/L
description: Denotes a PR that changes 100-499 lines, ignoring generated files.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: lgtm
description: "Looks good to me", indicates that a PR is ready to be merged.
Created: 2025-04-29T21:08:48Z | Merged: 2025-04-30T18:15:56Z

Fixes #2392

tar-fs only depends on MIT, ISC and Apache 2 licensed dependencies.

Linked issue #2392: BlueOak-1.0.0 license is not approved by CNCF
`package.json` lists several dependencies that are licensed under the `BlueOak-1.0.0` license. That license is not listed as an [approved CNCF license](https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#cncf-allowlist-license-policy).

The packages are also not listed in the [exception lists](https://github.com/cncf/foundation/tree/main/license-exceptions).

Are there any plans to resolve this?

Possible ways:
* Get the license added to the CNCF Approved List
* Apply for a CNCF exception for the specific modules
* Ask the maintainer of the modules to add a dual-license for one of the approved licenses
* Replace the dependencies with something else
Linked issue comments: user: login: jandubois
created_at: 2025-04-25T21:26:21Z
body: The problematic dependencies are:

```json
[
  "chownr",
  "3.0.0",
  "BlueOak-1.0.0",
  "git://github.com/isaacs/chownr.git",
  "http://blog.izs.me/",
  "Isaac Z. Schlueter"
]
[
  "jackspeak",
  "3.4.3",
  "BlueOak-1.0.0",
  "git+https://github.com/isaacs/jackspeak.git",
  "Unknown",
  "Isaac Z. Schlueter"
]
[
  "package-json-from-dist",
  "1.0.1",
  "BlueOak-1.0.0",
  "git+https://github.com/isaacs/package-json-from-dist.git",
  "https://izs.me/",
  "Isaac Z. Schlueter"
]
[
  "path-scurry",
  "1.11.1",
  "BlueOak-1.0.0",
  "git+https://github.com/isaacs/path-scurry",
  "https://blog.izs.me/",
  "Isaac Z. Schlueter"
]
[
  "yallist",
  "5.0.0",
  "BlueOak-1.0.0",
  "git+https://github.com/isaacs/yallist.git",
  "http://blog.izs.me/",
  "Isaac Z. Schlueter"
]
```
author_association: NONE
user: login: cjihrig
created_at: 2025-04-25T22:45:46Z
body: These are all indirect dependencies.

`chownr` and `yallist` come from our dependency on `tar`.

`jackspeak`, `package-json-from-dist`, and `path-scurry` come from our dependency on `c8`.
author_association: CONTRIBUTOR
user: login: jandubois
created_at: 2025-04-25T22:57:22Z
body: > These are all indirect dependencies.

It is my understanding that CNCF license approval requirement applies to indirect dependencies as well. Is that not the case?

Otherwise you could just create a wrapper with an approved license around a module and circumvent the whole license checking. The whole point of an official list is that the CNCF confirms that it considers the licenses compatible.
author_association: NONE
user: login: cjihrig
created_at: 2025-04-25T23:00:22Z
body: I don't know the policy. Without any investigation, I would assume it applies to all dependencies, direct or otherwise. I just wanted to document where these dependencies were coming from in case changes need to be made.
author_association: CONTRIBUTOR
user: login: mattfarina
created_at: 2025-04-26T12:39:31Z
body: [The license policy for the whole CNCF can be found here](https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#cncf-allowlist-license-policy). It applies to all dependencies not just direct ones. The approved exceptions can be found [here](https://github.com/cncf/foundation/tree/main/license-exceptions). The `BlueOak-1.0.0` license is not an approved one.
author_association: NONE
user: login: cjihrig
created_at: 2025-04-26T15:11:39Z
body: It might be worth applying for an exception. BlueOak is [OSI approved](https://opensource.org/license/blue-oak-model-license) and, if I recall correctly, was recently approved by the OpenJS Foundation.
author_association: CONTRIBUTOR
user: login: brendandburns
created_at: 2025-04-27T19:49:32Z
body: fwiw, `c8` is a dev dependency for running tests, not a runtime dependency, so I don't think that the CNCF policy applies. I agree it's a little weird since `package.json` combines both runtime and dev dependencies in a way that other language ecosystems don't.

@mattfarina if you feel like clarifying this with the CNCF/LF legal folks, feel free to reply here with what you find out.

author_association: CONTRIBUTOR
user: login: jandubois
created_at: 2025-04-28T18:58:57Z
body: > `c8` is a dev dependency for running tests, not a runtime dependency, so I don't think that the CNCF policy applies.

I would think so too, but will leave it to @mattfarina to give us the final word.

We had some corruption in our `yarn.lock` file that seems to have caused the `c8` dependencies to be included in the `yarn license list --prod` output. After recreating `yarn.lock` it only shows the 2 `tar` dependencies anymore:

```console
$ ~/suse/rancher-desktop/scripts/node-license-check.sh
Forbidden license(s) detected; allowed are Apache-2.0|0?BSD|ISC|MIT|Python-2.0|Unlicense
[
  "chownr",
  "3.0.0",
  "BlueOak-1.0.0",
  "git://github.com/isaacs/chownr.git",
  "http://blog.izs.me/",
  "Isaac Z. Schlueter"
]
[
  "yallist",
  "5.0.0",
  "BlueOak-1.0.0",
  "git+https://github.com/isaacs/yallist.git",
  "http://blog.izs.me/",
  "Isaac Z. Schlueter"
]
```
author_association: NONE
user: login: brendandburns
created_at: 2025-04-29T17:30:09Z
body: I'll move the `tar` dependency to be optional since it is only used for `copy` anyway.

That way people get to chose to install it or not for themselves.
author_association: CONTRIBUTOR
user: login: brendandburns
created_at: 2025-04-29T17:32:28Z
body: Actually, I'm going to look into switching to https://www.npmjs.com/package/nanotar which is MIT licensed has no dependencies.
author_association: CONTRIBUTOR

Diff:
diff --git a/package-lock.json b/package-lock.json
index ef67444f69a..356f1f9e7a0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,8 +13,6 @@
                 "@types/node": "^22.0.0",
                 "@types/node-fetch": "^2.6.9",
                 "@types/stream-buffers": "^3.0.3",
-                "@types/tar": "^6.1.1",
-                "@types/ws": "^8.5.4",
                 "form-data": "^4.0.0",
                 "hpagent": "^1.2.0",
                 "isomorphic-ws": "^5.0.0",
@@ -25,9 +23,7 @@
                 "rfc4648": "^1.3.0",
                 "socks-proxy-agent": "^8.0.4",
                 "stream-buffers": "^3.0.2",
-                "tar": "^7.0.0",
-                "tmp-promise": "^3.0.2",
-                "ws": "^8.18.0"
+                "tar-fs": "^3.0.8"
             },
             "devDependencies": {
                 "@eslint/js": "^9.18.0",
@@ -766,27 +762,6 @@
                 "node": ">=12"
             }
         },
-        "node_modules/@isaacs/fs-minipass": {
-            "version": "4.0.1",
-            "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
-            "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
-            "license": "ISC",
-            "dependencies": {
-                "minipass": "^7.0.4"
-            },
-            "engines": {
-                "node": ">=18.0.0"
-            }
-        },
-        "node_modules/@isaacs/fs-minipass/node_modules/minipass": {
-            "version": "7.1.2",
-            "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-            "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-            "license": "ISC",
-            "engines": {
-                "node": ">=16 || 14 >=14.17"
-            }
-        },
         "node_modules/@istanbuljs/schema": {
             "version": "0.1.3",
             "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
@@ -1022,16 +997,6 @@
                 "@types/node": "*"
             }
         },
-        "node_modules/@types/tar": {
-            "version": "6.1.13",
-            "resolved": "https://registry.npmjs.org/@types/tar/-/tar-6.1.13.tgz",
-            "integrity": "sha512-IznnlmU5f4WcGTh2ltRu/Ijpmk8wiWXfF0VA4s+HPjHZgvFggk1YaIkbo5krX/zUCzWF8N/l4+W/LNxnvAJ8nw==",
-            "license": "MIT",
-            "dependencies": {
-                "@types/node": "*",
-                "minipass": "^4.0.0"
-            }
-        },
         "node_modules/@types/unist": {
             "version": "3.0.3",
             "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -1039,15 +1004,6 @@
             "dev": true,
             "license": "MIT"
         },
-        "node_modules/@types/ws": {
-            "version": "8.18.1",
-            "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
-            "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
-            "license": "MIT",
-            "dependencies": {
-                "@types/node": "*"
-            }
-        },
         "node_modules/@typescript-eslint/eslint-plugin": {
             "version": "8.31.1",
             "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.31.1.tgz",
@@ -1318,6 +1274,12 @@
             "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
             "license": "MIT"
         },
+        "node_modules/b4a": {
+            "version": "1.6.7",
+            "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.6.7.tgz",
+            "integrity": "sha512-OnAYlL5b7LEkALw87fUVafQw5rVR9RjwGd4KUwNQ6DrrNmaVaUCgLipfVlzrPQ4tWOR9P0IXGNOx50jYCCdSJg==",
+            "license": "Apache-2.0"
+        },
         "node_modules/balanced-match": {
             "version": "1.0.2",
             "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -1325,6 +1287,78 @@
             "dev": true,
             "license": "MIT"
         },
+        "node_modules/bare-events": {
+            "version": "2.5.4",
+            "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.5.4.tgz",
+            "integrity": "sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA==",
+            "license": "Apache-2.0",
+            "optional": true
+        },
+        "node_modules/bare-fs": {
+            "version": "4.1.3",
+            "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.1.3.tgz",
+            "integrity": "sha512-OeEZYIg+2qepaWLyphaOXHAHKo3xkM8y3BeGAvHdMN8GNWvEAU1Yw6rYpGzu/wDDbKxgEjVeVDpgGhDzaeMpjg==",
+            "license": "Apache-2.0",
+            "optional": true,
+            "dependencies": {
+                "bare-events": "^2.5.4",
+                "bare-path": "^3.0.0",
+                "bare-stream": "^2.6.4"
+            },
+            "engines": {
+                "bare": ">=1.16.0"
+            },
+            "peerDependencies": {
+                "bare-buffer": "*"
+            },
+            "peerDependenciesMeta": {
+                "bare-buffer": {
+                    "optional": true
+                }
+            }
+        },
+        "node_modules/bare-os": {
+            "version": "3.6.1",
+            "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.6.1.tgz",
+            "integrity": "sha512-uaIjxokhFidJP+bmmvKSgiMzj2sV5GPHaZVAIktcxcpCyBFFWO+YlikVAdhmUo2vYFvFhOXIAlldqV29L8126g==",
+            "license": "Apache-2.0",
+            "optional": true,
+            "engines": {
+                "bare": ">=1.14.0"
+            }
+        },
+        "node_modules/bare-path": {
+            "version": "3.0.0",
+            "resolved": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.0.tgz",
+            "integrity": "sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==",
+            "license": "Apache-2.0",
+            "optional": true,
+            "dependencies": {
+                "bare-os": "^3.0.1"
+            }
+        },
+        "node_modules/bare-stream": {
+            "version": "2.6.5",
+            "resolved": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.6.5.tgz",
+            "integrity": "sha512-jSmxKJNJmHySi6hC42zlZnq00rga4jjxcgNZjY9N5WlOe/iOoGRtdwGsHzQv2RlH2KOYMwGUXhf2zXd32BA9RA==",
+            "license": "Apache-2.0",
+            "optional": true,
+            "dependencies": {
+                "streamx": "^2.21.0"
+            },
+            "peerDependencies": {
+                "bare-buffer": "*",
+                "bare-events": "*"
+            },
+            "peerDependenciesMeta": {
+                "bare-buffer": {
+                    "optional": true
+                },
+                "bare-events": {
+                    "optional": true
+                }
+            }
+        },
         "node_modules/brace-expansion": {
             "version": "2.0.1",
             "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
@@ -1432,15 +1466,6 @@
                 "url": "https://github.com/chalk/chalk?sponsor=1"
             }
         },
-        "node_modules/chownr": {
-            "version": "3.0.0",
-            "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-            "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
-            "license": "BlueOak-1.0.0",
-            "engines": {
-                "node": ">=18"
-            }
-        },
         "node_modules/cliui": {
             "version": "8.0.1",
             "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
@@ -1641,6 +1666,15 @@
             "dev": true,
             "license": "MIT"
         },
+        "node_modules/end-of-stream": {
+            "version": "1.4.4",
+            "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
+            "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+            "license": "MIT",
+            "dependencies": {
+                "once": "^1.4.0"
+            }
+        },
         "node_modules/entities": {
             "version": "4.5.0",
             "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
@@ -1968,6 +2002,12 @@
             "dev": true,
             "license": "MIT"
         },
+        "node_modules/fast-fifo": {
+            "version": "1.3.2",
+            "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+            "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+            "license": "MIT"
+        },
         "node_modules/fast-glob": {
             "version": "3.3.3",
             "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
@@ -2794,51 +2834,6 @@
                 "url": "https://github.com/sponsors/isaacs"
             }
         },
-        "node_modules/minipass": {
-            "version": "4.2.8",
-            "resolved": "https://registry.npmjs.org/minipass/-/minipass-4.2.8.tgz",
-            "integrity": "sha512-fNzuVyifolSLFL4NzpF+wEF4qrgqaaKX0haXPQEdQ7NKAN+WecoKMHV09YcuL/DHxrUsYQOK3MiuDf7Ip2OXfQ==",
-            "license": "ISC",
-            "engines": {
-                "node": ">=8"
-            }
-        },
-        "node_modules/minizlib": {
-            "version": "3.0.2",
-            "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.0.2.tgz",
-            "integrity": "sha512-oG62iEk+CYt5Xj2YqI5Xi9xWUeZhDI8jjQmC5oThVH5JGCTgIjr7ciJDzC7MBzYd//WvR1OTmP5Q38Q8ShQtVA==",
-            "license": "MIT",
-            "dependencies": {
-                "minipass": "^7.1.2"
-            },
-            "engines": {
-                "node": ">= 18"
-            }
-        },
-        "node_modules/minizlib/node_modules/minipass": {
-            "version": "7.1.2",
-            "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-            "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-            "license": "ISC",
-            "engines": {
-                "node": ">=16 || 14 >=14.17"
-            }
-        },
-        "node_modules/mkdirp": {
-            "version": "3.0.1",
-            "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-3.0.1.tgz",
-            "integrity": "sha512-+NsyUUAZDmo6YVHzL/stxSu3t9YS1iljliy3BSDrXJ/dkn1KYdmtZODGGjLcc9XLgVVpH4KshHB8XmZgMhaBXg==",
-            "license": "MIT",
-            "bin": {
-                "mkdirp": "dist/cjs/src/bin.js"
-            },
-            "engines": {
-                "node": ">=10"
-            },
-            "funding": {
-                "url": "https://github.com/sponsors/isaacs"
-            }
-        },
         "node_modules/mock-fs": {
             "version": "5.5.0",
             "resolved": "https://registry.npmjs.org/mock-fs/-/mock-fs-5.5.0.tgz",
@@ -2916,6 +2911,15 @@
                 "url": "https://github.com/sponsors/panva"
             }
         },
+        "node_modules/once": {
+            "version": "1.4.0",
+            "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+            "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+            "license": "ISC",
+            "dependencies": {
+                "wrappy": "1"
+            }
+        },
         "node_modules/openid-client": {
             "version": "6.4.2",
             "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-6.4.2.tgz",
@@ -3150,6 +3154,16 @@
                 "node": ">= 8"
             }
         },
+        "node_modules/pump": {
+            "version": "3.0.2",
+            "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.2.tgz",
+            "integrity": "sha512-tUPXtzlGM8FE3P0ZL6DVs/3P58k9nk8/jZeQCurTJylQA8qFYzHFfhBJkuqyE0FifOsQ0uKWekiZ5g8wtr28cw==",
+            "license": "MIT",
+            "dependencies": {
+                "end-of-stream": "^1.1.0",
+                "once": "^1.3.1"
+            }
+        },
         "node_modules/punycode": {
             "version": "2.3.1",
             "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
@@ -3364,6 +3378,19 @@
                 "node": ">= 0.10.0"
             }
         },
+        "node_modules/streamx": {
+            "version": "2.22.0",
+            "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.22.0.tgz",
+            "integrity": "sha512-sLh1evHOzBy/iWRiR6d1zRcLao4gGZr3C1kzNz4fopCOKJb6xD9ub8Mpi9Mr1R6id5o43S+d93fI48UC5uM9aw==",
+            "license": "MIT",
+            "dependencies": {
+                "fast-fifo": "^1.3.2",
+                "text-decoder": "^1.1.0"
+            },
+            "optionalDependencies": {
+                "bare-events": "^2.2.0"
+            }
+        },
         "node_modules/string-width": {
             "version": "5.1.2",
             "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
@@ -3494,30 +3521,29 @@
                 "node": ">=8"
             }
         },
-        "node_modules/tar": {
-            "version": "7.4.3",
-            "resolved": "https://registry.npmjs.org/tar/-/tar-7.4.3.tgz",
-            "integrity": "sha512-5S7Va8hKfV7W5U6g3aYxXmlPoZVAwUMy9AOKyF2fVuZa2UD3qZjg578OrLRt8PcNN1PleVaL/5/yYATNL0ICUw==",
-            "license": "ISC",
+        "node_modules/tar-fs": {
+            "version": "3.0.8",
+            "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-3.0.8.tgz",
+            "integrity": "sha512-ZoROL70jptorGAlgAYiLoBLItEKw/fUxg9BSYK/dF/GAGYFJOJJJMvjPAKDJraCXFwadD456FCuvLWgfhMsPwg==",
+            "license": "MIT",
             "dependencies": {
-                "@isaacs/fs-minipass": "^4.0.0",
-                "chownr": "^3.0.0",
-                "minipass": "^7.1.2",
-                "minizlib": "^3.0.1",
-                "mkdirp": "^3.0.1",
-                "yallist": "^5.0.0"
+                "pump": "^3.0.0",
+                "tar-stream": "^3.1.5"
             },
-            "engines": {
-                "node": ">=18"
+            "optionalDependencies": {
+                "bare-fs": "^4.0.1",
+                "bare-path": "^3.0.0"
             }
         },
-        "node_modules/tar/node_modules/minipass": {
-            "version": "7.1.2",
-            "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-            "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-            "license": "ISC",
-            "engines": {
-                "node": ">=16 || 14 >=14.17"
+        "node_modules/tar-stream": {
+            "version": "3.1.7",
+            "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
+            "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
+            "license": "MIT",
+            "dependencies": {
+                "b4a": "^1.6.4",
+                "fast-fifo": "^1.2.0",
+                "streamx": "^2.15.0"
             }
         },
         "node_modules/test-exclude": {
@@ -3535,6 +3561,15 @@
                 "node": ">=18"
             }
         },
+        "node_modules/text-decoder": {
+            "version": "1.2.3",
+            "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz",
+            "integrity": "sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==",
+            "license": "Apache-2.0",
+            "dependencies": {
+                "b4a": "^1.6.4"
+            }
+        },
         "node_modules/tinyexec": {
             "version": "0.3.2",
             "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.2.tgz",
@@ -3542,24 +3577,6 @@
             "dev": true,
             "license": "MIT"
         },
-        "node_modules/tmp": {
-            "version": "0.2.3",
-            "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.3.tgz",
-            "integrity": "sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==",
-            "license": "MIT",
-            "engines": {
-                "node": ">=14.14"
-            }
-        },
-        "node_modules/tmp-promise": {
-            "version": "3.0.3",
-            "resolved": "https://registry.npmjs.org/tmp-promise/-/tmp-promise-3.0.3.tgz",
-            "integrity": "sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==",
-            "license": "MIT",
-            "dependencies": {
-                "tmp": "^0.2.0"
-            }
-        },
         "node_modules/to-regex-range": {
             "version": "5.0.1",
             "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -3878,11 +3895,18 @@
                 "url": "https://github.com/chalk/ansi-styles?sponsor=1"
             }
         },
+        "node_modules/wrappy": {
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+            "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+            "license": "ISC"
+        },
         "node_modules/ws": {
             "version": "8.18.1",
             "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.1.tgz",
             "integrity": "sha512-RKW2aJZMXeMxVpnZ6bck+RswznaxmzdULiBr6KY7XkTnW8uvt0iT9H5DkHUChXrc+uurzwa0rVI16n/Xzjdz1w==",
             "license": "MIT",
+            "peer": true,
             "engines": {
                 "node": ">=10.0.0"
             },
@@ -3909,15 +3933,6 @@
                 "node": ">=10"
             }
         },
-        "node_modules/yallist": {
-            "version": "5.0.0",
-            "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-            "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-            "license": "BlueOak-1.0.0",
-            "engines": {
-                "node": ">=18"
-            }
-        },
         "node_modules/yaml": {
             "version": "2.7.1",
             "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.1.tgz",
diff --git a/package.json b/package.json
index 7140c5cf26d..55f4cc86784 100644
--- a/package.json
+++ b/package.json
@@ -59,8 +59,6 @@
         "@types/node": "^22.0.0",
         "@types/node-fetch": "^2.6.9",
         "@types/stream-buffers": "^3.0.3",
-        "@types/tar": "^6.1.1",
-        "@types/ws": "^8.5.4",
         "form-data": "^4.0.0",
         "hpagent": "^1.2.0",
         "isomorphic-ws": "^5.0.0",
@@ -71,9 +69,7 @@
         "rfc4648": "^1.3.0",
         "socks-proxy-agent": "^8.0.4",
         "stream-buffers": "^3.0.2",
-        "tar": "^7.0.0",
-        "tmp-promise": "^3.0.2",
-        "ws": "^8.18.0"
+        "tar-fs": "^3.0.8"
     },
     "devDependencies": {
         "@eslint/js": "^9.18.0",
diff --git a/src/cp.ts b/src/cp.ts
index d84d34cf860..702498f1944 100644
--- a/src/cp.ts
+++ b/src/cp.ts
@@ -1,7 +1,5 @@
-import fs from 'node:fs';
 import { WritableStreamBuffer } from 'stream-buffers';
-import * as tar from 'tar';
-import tmp from 'tmp-promise';
+import tar from 'tar-fs';
 
 import { KubeConfig } from './config.js';
 import { Exec } from './exec.js';
@@ -26,10 +24,8 @@ export class Cp {
         srcPath: string,
         tgtPath: string,
     ): Promise<void> {
-        const tmpFile = tmp.fileSync();
-        const tmpFileName = tmpFile.name;
         const command = ['tar', 'zcf', '-', srcPath];
-        const writerStream = fs.createWriteStream(tmpFileName);
+        const writerStream = tar.extract(tgtPath);
         const errStream = new WritableStreamBuffer();
         this.execInstance.exec(
             namespace,
@@ -44,10 +40,6 @@ export class Cp {
                 if (errStream.size()) {
                     throw new Error(`Error from cpFromPod - details: \n ${errStream.getContentsAsString()}`);
                 }
-                await tar.x({
-                    file: tmpFileName,
-                    cwd: tgtPath,
-                });
             },
         );
     }
@@ -66,16 +58,8 @@ export class Cp {
         srcPath: string,
         tgtPath: string,
     ): Promise<void> {
-        const tmpFile = tmp.fileSync();
-        const tmpFileName = tmpFile.name;
         const command = ['tar', 'xf', '-', '-C', tgtPath];
-        await tar.c(
-            {
-                file: tmpFile.name,
-            },
-            [srcPath],
-        );
-        const readStream = fs.createReadStream(tmpFileName);
+        const readStream = tar.pack(srcPath);
         const errStream = new WritableStreamBuffer();
         this.execInstance.exec(
             namespace,


Reviews:
user: login: cjihrig
body: Left a couple comments.

I'm good with this approach, but I do think it might be worthwhile to also pursue a license exception for BlueOak. I realize JavaScript isn't the primary language of most CNCF projects, but I would be surprised if this didn't happen again in some CNCF controlled repo. My understanding is that Isaac (the author of all of the packages in #2392) intends to move all of his modules to this license over time, and a lot of those modules are heavily depended on.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T22:09:35Z
user: login: brendandburns
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T22:42:12Z
user: login: brendandburns
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T22:42:18Z
user: login: cjihrig
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T00:25:01Z
user: login: brendandburns
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T16:49:50Z
user: login: cjihrig
body: Thanks. It's great to remove dependencies.

/lgtm
/approve
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T18:14:52Z

Review comments:
diff_hunk: @@ -1,10 +1,12 @@
-import fs from 'node:fs';
+import fs, { rmSync } from 'node:fs';
 import { WritableStreamBuffer } from 'stream-buffers';
-import * as tar from 'tar';
path: src/cp.ts
user: login: cjihrig
body: There are some linter errors in this file.
created_at: 2025-04-29T22:02:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -72,6 +72,7 @@
         "socks-proxy-agent": "^8.0.4",
         "stream-buffers": "^3.0.2",
         "tar": "^7.0.0",
path: package.json
user: login: cjihrig
body: `tar` should be removed from this file and `package-lock.json`
created_at: 2025-04-29T22:03:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,10 +1,12 @@
-import fs from 'node:fs';
+import fs, { rmSync } from 'node:fs';
 import { WritableStreamBuffer } from 'stream-buffers';
-import * as tar from 'tar';
path: src/cp.ts
user: login: brendandburns
body: fixed.
created_at: 2025-04-29T22:42:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -72,6 +72,7 @@
         "socks-proxy-agent": "^8.0.4",
         "stream-buffers": "^3.0.2",
         "tar": "^7.0.0",
path: package.json
user: login: brendandburns
body: fixed.
created_at: 2025-04-29T22:42:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,7 +1,5 @@
-import fs from 'node:fs';
 import { WritableStreamBuffer } from 'stream-buffers';
-import * as tar from 'tar';
-import tmp from 'tmp-promise';
path: src/cp.ts
user: login: cjihrig
body: Sorry for the back and forth - I think this is the only use of this dependency in the project. If it's removed here, it can be removed from package.json and package-lock.json too.
created_at: 2025-04-30T00:24:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,7 +1,5 @@
-import fs from 'node:fs';
 import { WritableStreamBuffer } from 'stream-buffers';
-import * as tar from 'tar';
-import tmp from 'tmp-promise';
path: src/cp.ts
user: login: brendandburns
body: Done (and removed `ws` also since it is not a direct dependency)
created_at: 2025-04-30T16:49:50Z
author_association: CONTRIBUTOR

PR comments:
user: login: k8s-ci-robot
created_at: 2025-04-30T18:14:56Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-client/javascript/pull/2402#" title="Author self-approved">brendandburns</a>*, *<a href="https://github.com/kubernetes-client/javascript/pull/2402#pullrequestreview-2808019510" title="Approved">cjihrig</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-client%2Fjavascript).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-client/javascript/blob/main/OWNERS)~~ [brendandburns,cjihrig]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR