fix(deps): override tar to >=7.5.22 (clears the 1 critical npm audit vuln)

[rubenvdlinde]

fix(deps): override tar to >=7.5.22 (clears the 1 critical npm audit vuln)

The Code Quality 'npm audit' gate runs --audit-level=critical and failed on the
single critical: tar <=7.5.20 (node-tar PAX file-smuggling / DoS chain,
GHSA-vmf3-w455-68vh et al.), pulled transitively at 7.5.11 by node-gyp/cacache
(dev-only build tooling — not in the webpack bundle). Add a tar >=7.5.22
override; lock diff is tar-only. The remaining high/moderate/low advisories are
below the gate's critical threshold (tracked separately).

---

Sweep metadata

• Verified to merge cleanly into development as of e9a65e722 (tested by an actual merge, not a heuristic)
• Contribution: 2 files changed, 4 insertions(+), 3 deletions(-)
• Last commit: 4 days ago

Opened as part of a sweep of unmerged branches. Authored by an earlier session — the body above is that branch's own commit message, unedited. I have not reviewed the content; this PR exists so the work is visible and reviewable rather than sitting on an unmerged branch. Merge on its own merits.

[github-actions]

Quality Report — ConductionNL/openregister @ e5d572e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 174/174
npm			✅	✅ 555/555
PHPUnit					✅
Newman					✅
Playwright					⏭️

---

Quality workflow — 2026-07-30 05:15 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 23a0b29

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 174/174
npm			✅	✅ 713/713
PHPUnit					✅
Newman					✅
Playwright					✅

---

Quality workflow — 2026-08-04 01:35 UTC

Download the full PDF report from the workflow artifacts.