chore: upgrade tar to ^7.5.22 to address CVE-2026-59874 and GHSA-r292-9mhp-454m

[linear-code]

Fixes SOU-1554
Fixes SOU-1629

Summary

Refreshes the yarn.lock entry for tar to 7.5.22, which is above the patched floors for:

• CVE-2026-59874 (fixed in 7.5.18)
• GHSA-r292-9mhp-454m (fixed in 7.5.21)

tar is a transitive dependency through node-gyp and cacache; both request ^7.4.3, so the existing supported range admits the patched version. No package.json change or resolutions override is required.

The branch is merged with current main, replacing the previous 7.5.20 lockfile selection with 7.5.22.

Verification

• yarn install --immutable
• yarn why tar --recursive selects only tar@npm:7.5.22
• yarn test (115 files, 1,789 tests pass)
• git diff --check

---

Note

Low Risk
Lockfile-only security patch with no application code or direct dependency range changes; behavior impact is limited to the install/tooling stack that uses tar.

Overview
Bumps the locked transitive tar dependency from 7.5.20 to 7.5.22 in yarn.lock and records the change under [Unreleased] in CHANGELOG.md. No package.json or Yarn resolutions changes—callers still request ^7.4.3, which already allows the patched release.

This addresses CVE-2026-59874 (fixed in 7.5.18) and GHSA-r292-9mhp-454m (fixed in 7.5.21). tar is pulled in via node-gyp and cacache during native module installs, not application runtime logic.

^{Reviewed by Cursor Bugbot for commit 3b8fb95. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2200
Resolved (non-standard)	17
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.12	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (17)

Package	Version	Original	Resolved	Source
@sentry/cli	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-darwin	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-linux-arm	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-linux-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-linux-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-linux-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-win32-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-win32-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
@sentry/cli-win32-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry manifest 2.58.5 + upstream LICENSE at tag 2.58.5 (GitHub repo)
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo LICENSE (Apache-2.0 text) + README license section; npm manifest has no license field
khroma	2.1.0	UNKNOWN	MIT	GitHub repo license file (MIT text); npm manifest has no license field
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo LICENSE (Apache-2.0 text) + README license section; npm manifest has no license field
map-stream	0.1.0	UNKNOWN	MIT	GitHub repo LICENCE (MIT text); npm manifest has no license field
memorystream	0.3.1	UNKNOWN	MIT	extracted from object: manifest "licenses":[{"type":"MIT"}], confirmed by GitHub repo LICENSE (MIT text)
pause-stream	0.0.11	MIT,Apache2	MIT OR Apache-2.0	extracted from array-valued license field ["MIT","Apache2"], confirmed by package LICENSE ("Dual Licensed MIT and Apache 2")
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	package LICENSE file referenced by "SEE LICENSE IN LICENSE" (Apache-2.0 text), confirmed on GitHub repo
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo LICENSE (MIT text); npm manifest has no license field