fix: resolve Dependabot tar vulnerability

[mattinannt]

Summary

• add a pnpm override to force tar to 7.5.7
• regenerate pnpm-lock.yaml so transitive Expo CLI resolution uses patched tar

Why

Dependabot reports tar < 7.5.7 in pnpm-lock.yaml (transitive dependency path via Expo CLI).

Notes

Lockfile refresh also updated one existing alias line in snapshots (@babel/traverse--for-generate-function-map).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Walkthrough

The pull request modifies package.json to add a new pnpm dependency override entry for tar version 7.5.7. This addition to the pnpm.overrides configuration ensures that the tar package resolves to version 7.5.7 across the project. The existing js-yaml override configuration remains unchanged. The modification results in 2 lines added and 1 line removed in the file.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: resolving a Dependabot-reported tar vulnerability by adding a pnpm override.
Description check	✅ Passed	The description directly relates to the changeset, explaining the vulnerability fix, the pnpm override added, and the lockfile regeneration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into main

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

No actionable comments were generated in the recent review. 🎉

🧹 Recent nitpick comments

package.json (1)

29-29: Consider using >=7.5.7 instead of an exact pin for consistency and future-proofing.

All other overrides in this block use >= ranges (>=1.1.0, >=11.1.0, >=1.3.2, >=4.1.1), which automatically pick up future patch releases. Pinning tar to exactly 7.5.7 means a future security fix (e.g., 7.5.8) won't be adopted until this override is manually updated. Since tar 7.5.7 addresses CVE-2026-24842 and the team has been actively releasing patches in the 7.5.x line, using >=7.5.7 would be both consistent with the pattern and safer for receiving future security updates.

Suggested change

-      "tar": "7.5.7"
+      "tar": ">=7.5.7"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}