docs: add CHANGELOG entry for tar CVE fix

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1552/sourcebot-devsourcebot-cve-2026-59871-node-tar-node-tar-denial-of#agent-session-212881c4)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>

Author: linear-code[bot]

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Upgraded `tar` to `^7.5.18`. [#1468](https://github.com/sourcebot-dev/sourcebot/pull/1468)
+
 ## [5.1.3] - 2026-07-20
 
 ### Added