[TOOL-5898] Update tar to >=7.5.4 to resolve CVE-2026-23950

[ThomasTrepanier]

This change is 

---

Summary

• Added resolutions in package.json to force tar@>=7.5.4, resolving CVE-2026-23950 (high severity race condition in node-tar path reservations via Unicode collisions on macOS APFS).
• Upstream @yarnpkg/core (latest 4.5.0) still depends on tar@^6 with no patched v6 release available, so a resolution override was the only viable fix path.
• All tar instances now resolve to 7.5.9.
• Jira: https://maintainx.atlassian.net/browse/TOOL-5898

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[cursor]

Untested tar v7 compatibility with Yarn internals

Medium Severity

Forcing tar@^7.5.4 via resolutions upgrades @yarnpkg/core from its expected tar@^6 dependency to v7, which includes a breaking change: the chmod option now defaults to false instead of implicitly true. This means extracted files won't preserve permissions from tar archives by default. While this likely won't affect normal package extraction (system defaults apply), it's an untested configuration that could cause unexpected behavior with executable files or special permissions if Yarn's internal code relies on tar v6's permission-preserving behavior.

 

[BobbyWhiskey]

@BobbyWhiskey reviewed 2 files and all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on cptCloud and ThomasTrepanier).