chore: upgrade tar to ^7.5.22 to address CVE-2026-59874 and GHSA-r292-9mhp-454m (#1472)

* chore: upgrade tar to ^7.5.20 to address CVE-2026-59874

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1554/sourcebot-devsourcebot-cve-2026-59874-tar-node-tar-denial-of-service#agent-session-87c65d74)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>

* docs: add CHANGELOG entry for tar upgrade

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1554/sourcebot-devsourcebot-cve-2026-59874-tar-node-tar-denial-of-service#agent-session-87c65d74)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>

---------

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

Author: linear-code[bot]

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Upgraded `brace-expansion` to `^1.1.17`/`^2.1.3`/`^5.0.8`. [#1527](https://github.com/sourcebot-dev/sourcebot/pull/1527)
+- Upgraded `tar` to `^7.5.22`. [#1472](https://github.com/sourcebot-dev/sourcebot/pull/1472)
 
 ## [5.1.5] - 2026-07-31
 

yarn.lock

@@ -22574,15 +22574,15 @@ __metadata:
   linkType: hard
 
 "tar@npm:^7.4.3":
-  version: 7.5.20
-  resolution: "tar@npm:7.5.20"
+  version: 7.5.22
+  resolution: "tar@npm:7.5.22"
   dependencies:
     "@isaacs/fs-minipass": "npm:^4.0.0"
     chownr: "npm:^3.0.0"
     minipass: "npm:^7.1.2"
     minizlib: "npm:^3.1.0"
     yallist: "npm:^5.0.0"
-  checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a
+  checksum: 10c0/1311f6be85a8157ac4c9147bae43e13923d2a1aae15e4aa1bd5239e4e03d2cf53cfe103dde7f35832fbb4c938b042856bc8e9a0afd29abd05e2d1608788c4fea
   languageName: node
   linkType: hard