fix(deps): clear reachable security advisories, drop the @types/tar stub

.changeset/security-dependency-bumps.md

@@ -0,0 +1,18 @@
+---
+"playground-cli": patch
+---
+
+Clear the outstanding dependency security advisories that are actually
+reachable from the CLI.
+
+The one that mattered: `tar` was on 7.5.16, carrying a critical
+decompression/parse DoS. `playground mod` extracts GitHub tarballs of
+community-published apps with it, so that parser runs on attacker-controllable
+input by design — this was in the threat path, not theoretical. It now resolves
+to 7.5.22, and `@types/tar` (a deprecated stub; `tar` ships its own types, and
+it was the only thing still pulling a vulnerable 7.5.16) is removed.
+
+Also updated within the ranges their parents already declare, so no forced
+resolutions were needed: `@libp2p/peer-store`, `browserslist`, `postcss`,
+`brace-expansion`, `undici`, `axios`, `shell-quote`, `form-data`,
+`baseline-browser-mapping`, and `vitest` (with `@vitest/mocker`).

package.json

@@ -48,16 +48,15 @@
         "polkadot-api": "^2.2.1",
         "react": "^18.3.1",
         "react-devtools-core": "file:stubs/react-devtools-core",
-        "tar": "^7.5.16"
+        "tar": "^7.5.21"
     },
     "devDependencies": {
         "@biomejs/biome": "^1.9.4",
         "@changesets/cli": "^2.31.0",
         "@types/node": "^22.15.3",
         "@types/react": "^18.3.18",
-        "@types/tar": "^7.0.87",
         "execa": "^9.6.1",
         "typescript": "^5.9.3",
-        "vitest": "^4.1.8"
+        "vitest": "^4.1.11"
     }
 }