fix: bump yeoman-environment ^4 -> ^6 to clear tar CRITICAL (GHSA-23hp-3jrh-7fpw)

[AnujVishwakarma-src]

Problem

tar@6.2.1 — fixing CRITICAL advisory in the aio-cli tree (GHSA-23hp-3jrh-7fpw, node-tar decompression/parse DoS, patched at >=7.5.19) — remains in this plugin's production dependency tree via:

@adobe/aio-cli-plugin-app -> yeoman-environment@4.4.3 -> node-gyp@10.3.1 -> tar@6.2.1

The generator ESM migration (yeoman-generator v7) cleared the generator-side tar chain, but yeoman-environment is a separate direct prod dependency and was untouched — so this is the sole remaining source.

Fix

Bump yeoman-environment ^4.4.3 -> ^6.3.0. v6 pulls node-gyp@12 -> tar@7.5.22 (patched), removing tar@6.2.1.

yeoman-environment@6 requires Node ^20.17.0 || >=22.9.0, so engines.node is raised from >=20.5.0 to match. This keeps Node 20/22/24 support (v6 was chosen over v7 specifically because v7 drops Node 20). The env API used here — createEnv / env.instantiate / env.runGenerator — is unchanged between v4 and v6, and src/lib/create-yeoman-environment.js already loads it via dynamic import().

Validation

• npm audit critical: 1 -> 0 (tar@6.2.1 gone; tree now resolves tar@7.5.22, patched).
• 853 tests pass, 100% coverage, eslint clean.
• API compatibility confirmed: createEnv/instantiate/runGenerator present in v6.
• E2E (linked plugin, aio-cli 11.1.4, Node 26): aio app init, aio app add ci, aio app delete ci all run their generators end-to-end via yeoman-environment@6 (createEnv -> instantiate -> runGenerator).

Sequenced after #937 (ESM generator loads), per APPBLD-5140.

---

Node version compatibility (empirically tested 2026-09-24)

yeoman-environment@6's own engines are ^20.17.0 || >=22.9.0, which technically excludes Node 21.x and 22.0–22.8. To confirm this is advisory-only (EBADENGINE), not a runtime break, aio app init (full generator fleet via yeoman-environment@6 → createEnv/instantiate/runGenerator) was run on standalone Node binaries:

Node	v6 engines	Unit suite	aio app init E2E
20.17.0 (LTS 20 floor)	supported	✅ 853 pass, 100%	✅ scaffolded
21.7.3 (odd / non-LTS)	excluded	✅ 853 pass, 100%	✅ scaffolded (warn-only)
22.5.0 (pre-LTS, 22.0–22.8 gap)	excluded	✅ 853 pass, 100%	✅ scaffolded (warn-only)
24.10.0 (LTS 24)	supported	✅ 853 pass, 100%	✅ scaffolded
26.0.0 (current)	supported	✅ 853 pass, 100%	✅ scaffolded

Conclusion: nothing breaks on Node 21 or 22.0–22.8 — the CLI runs; EBADENGINE is only an advisory warning there. Those versions are non-LTS or superseded pre-LTS releases anyway; the epic's target LTS lines (20 @ ≥20.17, 22 @ ≥22.9/LTS 22.11, 24) are fully supported.

engines.node = >=20.17.0 (not ^20.17.0 || >=22.9.0): >=20.17.0 is the real minimum (below which yeoman-environment@6 won't install cleanly) and it covers Node 21 / 22.0–22.8 too — so plugin-app does not add self-inflicted EBADENGINE warnings on versions where the code demonstrably works.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!