[users/v-imaga/Security-update-bump-tar-to-4.4.15-or-later] fix: security-update-bump tar to 4.4.15 or later

[radium-v]

Pull Request

📖 Description

Updates tar lockfile entries to 4.4.17 and 6.1.8.

🎫 Issues

#5035

👩‍💻 Reviewer Notes

To replicate this process:

Prerequisite: install yarn-deduplicate globally with yarn global add yarn-deduplicate.

1. Clean your local workspace.
   git clean -dfx removes ALL untracked files! Use git clean -ndx first to see which files it will remove.
2. Identify the affected packages and their full entries in the lockfile. It will look something like this:

   package-name@^1.2.3, package-name@^1.2.5, package-name@^1.4.5:
     version "1.4.5"
     resolved "https://registry.yarnpkg.com/package-name/-/package-name-1.4.5.tgz#abcdef12345
     integrity sha512-abcdefghijklmnopqrstuvwxyz
     dependencies:
       another-package "^1.0.0"
       some-dependency "~3.4.5"
   

3. Remove the entire entry from the lockfile.
   A find/replace for the package name won't work because the items under a package's dependencies: are immutable! They can't be changed. Yarn will always ensure that the items under dependencies: match exactly what the package says it needs. If they changed, then it must mean that the version, resolved, and integrity have also changed. If an entry's dependencies changed but the version, resolved, and integrity haven't changed, then Yarn will revert it.
4. Run yarn --ignore-scripts to process the lockfile.
5. Run yarn-deduplicate
   This step is needed for the monorepo because of issues with Yarn v1.
6. Repeat steps 4 and 5 until the output reads success Already up-to-date.
   This step is needed because yarn-deduplicate doesn't sort entries, but Yarn does.
7. Stage and commit the lockfile changes.

✅ Checklist

General

• I have included a change request file using $ yarn change
• I have added tests for my changes.
• I have tested my changes.
• I have updated the project documentation to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the standards for this project.