Update package.json

[blubskye]

Fixes a circular dependency error, and a security vulnerability having to do with tar.

[samuelms1]

How does this fix the tar vulnerability? I'm not saying it doesn't, but it isn't obvious to me. I can see that node-sqlite3@5.0.2 => node-gyp@3.8.0 => tar@v2.2.2

I see this MR updates node-addon-api which I guess updates node-gyp?

[blubskye]

Because the older node version is what was causing the issue. You can try compiling it yourself, and then the audit command actually works. When before it didn't work. It wanted to downgrade the sqlite version for some reason.

[samuelms1]

I cloned the repo, used node v12.22.6, ran npm i, then ran npm ls, and checked the versions of tar. It was using tar@6.1.11 (not tar@2.2.2 which has the security vulnerability in sqlite@5.0.2).

I think the tar security issue was resolved with #1441. The node-sqlite3@5.0.2 was build in Feb and the fix was in March. I think it just needs to be republished with a new version.

[kewde]

Thanks eb7708a

[blubskye]

Yet the person did the same commit that I did, beautiful. At least it's fixed now.