build(deps): Bump the npm group with 4 updates

[dependabot]

Bumps pacote from 21.5.1 to 22.0.0,
make-fetch-happen from 15.0.6 to 16.0.1,
@npmcli/arborist from 9.9.0 to 10.0.2, and
licensee from 12.0.1 to 12.0.2.

All four packages now require Node ^22.22.2 || ^24.15.0 || >=26.0.0. The engine
constraint in the root package.json has been updated accordingly, and the overrides
block that patched tar into security-safe versions for older pacote/cacache/node-gyp
has been removed — it is no longer needed with these updated versions.

---

pacote 21.5.1 → 22.0.0

Release notes

Sourced from pacote's releases.

v22.0.0

⚠️ BREAKING CHANGES

• pacote now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• git specs using the https or git+https protocol now resolve to git+https URLs instead of being switched to git+ssh. Shortcut specs (e.g. github:user/repo, user/repo) and git+ssh/git:// specs are unchanged.

Bug Fixes

• ce804fb avoid ReDoS in addGitSha committish stripping (#498)
• 1f5f131 pass --global=false when preparing git dependencies
• e0af7f6 respect ignoreScripts option for git dependencies

Dependencies

• ssri@14.0.0, sigstore@5.0.0, proc-log@7.0.0, cacache@21.0.1
• @npmcli/run-script@11.0.0, @npmcli/git@8.0.0, @npmcli/package-json@8.0.0

Impact on this repo: pacote is used in @ui5/project for npm registry operations (packument, manifest, extract). None of these APIs changed. The git+https protocol change does not affect registry-spec fetching.

---

make-fetch-happen 15.0.6 → 16.0.1

Release notes

Sourced from make-fetch-happen's releases.

v16.0.1

⚠️ BREAKING CHANGES

• Node engine updated to ^22.22.2 || ^24.15.0 || >=26.0.0

Security

• Updated @npmcli/redact@5 — fixes credential leakage in URL logging

Dependencies

• minipass-fetch@6, proc-log@7, ssri@14, cacache@21, @npmcli/agent@5

Impact on this repo: Used in @ui5/project (maven/Registry.js) as a drop-in fetch replacement. No public API changes — internal dependency chain only.

---

@npmcli/arborist 9.9.0 → 10.0.2

Release notes

Sourced from arborist's releases.

v10.0.0

⚠️ BREAKING CHANGES

• Node engine updated to ^22.22.2 || ^24.15.0 || >=26.0.0
• npm-shrinkwrap.json is no longer loaded or honored by arborist — only package-lock.json is read as input
• Install scripts are now blocked by default unless explicitly allowed via allowScripts

Bug Fixes (v10.0.2)

• Fix crash during peer dependency backoff resolution
• Fix safe downgrade behavior during audit fix

Impact on this repo: Used only in internal/shrinkwrap-extractor via arb.loadVirtual() to traverse the monorepo's package-lock.json dependency graph. This is a read-only operation — reify() (which triggers install scripts) is never called. The shrinkwrap removal breaking change does not apply: the tool reads package-lock.json as input and produces npm-shrinkwrap.json as output itself; it never asks arborist to read a shrinkwrap file. All node properties used (tops, edgesOut, isLink, target, top, location, packageName, version, edge.dev, edge.to) are confirmed present and unchanged in v10.

---

licensee 12.0.1 → 12.0.2

Patch version bump. No code changes — package.json version field only. Dev dependency.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

We will bump subpackages as well

[matz3]

This updates our productive dependencies, so usually we would use deps as message type, right?

[RandomByte]

Commit message should have been deps: Bump the npm group with 4 updates, right?

[d3xter666]

Sorry messed it up!

[RandomByte]

Yeah, CI fails for this commit on main now: https://github.com/UI5/cli/actions/runs/33746835998/job/100621137323

Should we amend and force push? Not sure where else this might cause issues later.

[RandomByte]

I guess we need to find a way to block PR merges where final commit is not passing validation.