Merge pull request #739 from sid88in/fix/bump-tar-cve-2026-26960

fix(security): force serverless's tar to >=7.5.8 (CVE-2026-26960)

Author: sid88in

package-lock.json

@@ -55,6 +55,9 @@
     },
     "ajv-merge-patch": {
       "fast-json-patch": "3.1.1"
+    },
+    "serverless": {
+      "tar": "^7.5.8"
     }
   },
   "dependencies": {