fix(security): pin tar to 7.5.20 for CVE-2026-59873

Every tar release <= 7.5.18 is vulnerable to a decompression/parse DoS
via unlimited input (GHSA-23hp-3jrh-7fpw, CRITICAL). tar bounds neither the
volume of data it will decompress nor the size of a parsed entry, so a small
crafted archive can exhaust memory or CPU in the consuming process. Fixed
upstream in 7.5.19.

Because the whole 6.x line is affected too, there is no safe older major to
preserve, so the existing range-scoped override keys are replaced by a single
unscoped `tar` key - no declared spec can escape it. The previous redirect
targets were themselves inside the vulnerable range.

Pinned to 7.5.20 rather than the newest 7.5.22: 7.5.20 is the newest release
old enough to clear the repo minimumReleaseAge supply-chain gate.

Author: FJ-Riveros

pnpm-lock.yaml

@@ -19,7 +19,11 @@ blockExoticSubdeps: true
 # Security CVE pins migrated verbatim from the former package.json#pnpm.overrides
 overrides:
   "bigint-buffer": "npm:bigint-buffer-fixed@^1.1.5"
-  "tar": ">=7.5.11"
+  # GHSA-23hp-3jrh-7fpw / CVE-2026-59873 (CRITICAL): every tar <= 7.5.18 is
+  # vulnerable to a decompression/parse DoS via unlimited input, so the old
+  # `>=7.5.11` floor still resolved into the vulnerable range (7.5.16). Pinned
+  # exactly: 7.5.20 is the newest release that clears `minimumReleaseAge` above.
+  "tar": "7.5.20"
   "minimatch": ">=3.1.4"
   "axios": ">=1.16.0"
   "axios@1.14.1": ">=1.16.0"