chore(deps): override tar to >=7.5.19 (critical audit GHSA-23hp-3jrh-7fpw)

[TaprootFreak]

What

Add a single line to the existing overrides block in package.json:

"tar": ">=7.5.19"

This deduplicates both tar paths in the tree to tar@7.5.20:

• tar@4.4.19 (via web3 -> swarm-js)
• tar@6.2.1 (via bcrypt -> @mapbox/node-pre-gyp)

Why

CI's Security audit step runs npm audit --audit-level=critical and currently fails repo-wide on GHSA-23hp-3jrh-7fpw (node-tar - Denial of Service, CRITICAL, vulnerable <= 7.5.18). This is the only critical advisory in the tree, so it blocks the audit gate on every PR.

After this override:

• npm audit --audit-level=critical -> exit 0 (0 critical; the remaining 216 advisories are all low/moderate/high and pre-existing, unaffected by this change).
• GHSA-23hp-3jrh-7fpw no longer present.

Runtime risk: low

Neither vulnerable tar path is on a request-serving runtime code path:

• swarm-js (tar@4) is unreachable dead code pulled in transitively via web3.
• node-pre-gyp (tar@6) only runs at install time to unpack the prebuilt bcrypt binary.

The bump is a pure security-hygiene / CI-unblock change, confined entirely to the tar subtree.

Scope / confinement

• package.json: +1 line (one new entry in the pre-existing overrides block; no other override touched).
• package-lock.json: regenerated via npm install (not hand-edited). Every changed entry is within the tar dependency family only - the old tar@4 subtree under swarm-js collapses away and tar@6 upgrades to tar@7.5.20; chownr 2->3, minizlib 2->3, fs-minipass -> @isaacs/fs-minipass, yallist -> 5. No unrelated package changed.

Verification (Node 20)

• npm audit --audit-level=critical -> exit 0
• npm run build (nest build) -> exit 0
• tsc --noEmit -> exit 0
• bcrypt native module still loads with the new tar (valid $2b$ hash), proving the install-time unpack path is unaffected.

PR completeness

• Migration: n/a (no entity/column change)
• Environment/Infrastructure: n/a
• Service/Frontend sync: n/a (no API contract change)

[TaprootFreak]

CI fully green — the Security audit step now passes (0 critical). The change is a single overrides line pinning tar to >=7.5.19 (resolves to 7.5.20); the lockfile change is confined to the tar subtree, npm run build/tsc pass, and bcrypt's native module still loads and hashes. Real runtime risk of the advisory was low (both tar paths are non-runtime: swarm-js dead code + node-pre-gyp install-time), but it was hard-blocking the audit gate for every PR against develop. Ready for review/merge.