[chaitanyapotti]

Motivation and Context

Dependabot alerts #267 and #251 report tar 7.5.11. npm audit reports 6 tar advisories for versions up to 7.5.20. One of them is critical.

Description

Update tar from 7.5.11 to 7.5.22 in package-lock.json. The @lavamoat/harden → @yarnpkg/core chain brings in tar, and it accepts ^7.5.3. Thus package.json does not change. tar is a development dependency, so the published packages do not change.

This PR does not fix alert #369 (minimatch). The code for that advisory is not reachable here:

• minimatch 3.1.5 (from eslint and eslint-plugin-import) does not contain firstPhasePreProcess or optimizationLevel.
• minimatch 10.2.6 (from eslint-plugin-tsdoc → typescript-estree) contains the code. But typescript-estree calls minimatch with the default optimizationLevel of 1, and the bug needs level 2 or more.
• No fixed 3.x or 10.x release exists. Version 11 changes the API, so an override would break the minimatch 3 users.

How has this been tested?

• npm audit: 0 critical issues. 13 moderate issues remain, all from the minimatch advisory.
• npx harden check --package-manager npm: passes.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

---

Note

Low Risk
Dev-only dependency and lint peer version updates plus a transitive security patch; no runtime or published package behavior changes for consumers beyond declared peer ranges.

Overview
Addresses Dependabot tar advisories by resolving tar from 7.5.11 to 7.5.22 in the lockfile (pulled in via @lavamoat/harden); root package.json is unchanged for tar.

The same refresh also bumps lint dev tooling: oxlint-plugin-vize ^0.485.0 → ^0.608.0 (with matching @vizejs/native-* optional deps) and oxlint-tailwindcss ^1.14.0 → ^1.17.0 at the repo root and in @toruslabs/oxlint-config-react / @toruslabs/oxlint-config-vue peer ranges. check-presets.test.ts expectations and the tarball install fixture pin are updated to match.

^{Reviewed by Cursor Bugbot for commit f93da72. Bugbot is set up for automated code reviews on this repo. Configure here.}