fix(deps): node-gyp 9 to 11.5 clears critical tar alert without dropping Node 18/20; replace unpatched git-clone #98

Problem

node-srt ships node-gyp as a runtime dependency (^9.3.0, locked 9.3.0) because the package's install script runs node-gyp rebuild on every consumer's machine. node-gyp 9 pulls tar 6.1.12, and the Dependabot alerts API reads 13 open runtime tar alerts today, one critical (GHSA-23hp-3jrh-7fpw / CVE-2026-59873, tar <= 7.5.18, fixed 7.5.19) and eight high. Separately, scripts/build-srt-sdk.js:9 requires git-clone 0.1.0, which carries GHSA-8jmw-wjr8-2x66 (CVE-2022-25900, command injection, <= 0.2.0, no patched version exists), and it runs at install time too (build-srt-sdk.js:33, clone(srtRepoPath, srtSourcePath, { checkout: srtCheckout }, ...), where srtCheckout can come from NODE_SRT_CHECKOUT).

The existing route is stuck for a reason that does not apply to every fix: dependabot PR #87 jumps node-gyp 9 -> 13, and the triage bot correctly handed it to a maintainer (comments 2026-07-30 and 2026-08-11) because node-gyp 13 requires Node >= 22.22.2, which breaks the 18.x and 20.x rows of nodejs.yml's matrix [18.x, 20.x, 22.x, 24.x, 26.x].

There is a version that does not break the matrix. npm registry, read today: node-gyp@11.5.0 declares engines.node: "^18.17.0 || >=20.5.0" and depends on tar ^7.4.3, which resolves to a tar above 7.5.19. (12.x needs Node ^20.17, so it would drop 18.x; 10.x stays on tar 6.)

This is independent of the libSRT tracks in #89, #90, #91 and #93, which wait on an upstream Haivision/srt tag (newest is still v1.5.7, 2026-08-28). Nothing here touches SRT_CHECKOUT.

Fix (one deliverable: clear the install-time dependency exposure without dropping a supported Node version)

1. node-gyp ^9.3.0 -> ^11.5.0 in dependencies; regenerate the lock. Then close Bump tar and node-gyp #87 as superseded.
2. Replace the git-clone dependency in scripts/build-srt-sdk.js with a direct spawnSync('git', ['clone', '--depth', '1', '--branch', srtCheckout, srtRepoPath, srtSourcePath]) (argument array, no shell), already imported at line 11, and drop git-clone from package.json.

Acceptance

• npm ls tar shows no tar below 7.5.19; the critical GHSA-23hp-3jrh-7fpw and GHSA-8jmw-wjr8-2x66 read fixed in the alerts view.
• nodejs.yml passes on all five matrix rows, including 18.x and 20.x (the row Bump tar and node-gyp #87 broke).
• A clean npm install still builds the addon against v1.5.5 and against an overridden NODE_SRT_CHECKOUT.

Evidence read live 2026-10-08: package.json, package-lock.json, scripts/build-srt-sdk.js, .github/workflows/nodejs.yml on master; GET /repos/Eyevinn/node-srt/dependabot/alerts; PR #87 diff and comments; npm registry metadata for node-gyp 10.3.1, 11.5.0, 12.1.0.