chore: override tar to ^7.5.19, brace-expansion to ^5.0.8

Author: Sachin Hulyalkar

LICENSE-THIRD-PARTY

@@ -6547,7 +6547,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ******************************
 
 tar
-7.5.16 <https://github.com/isaacs/node-tar>
+7.5.22 <https://github.com/isaacs/node-tar>
 # Blue Oak Model License
 
 Version 1.0.0

build-tools/oss-attribution/oss-attribution-generator/package-lock.json

@@ -4,6 +4,6 @@
   },
   "overrides": {
     "minimatch": "^10.2.3",
-    "brace-expansion": "^5.0.6"
+    "brace-expansion": "^5.0.8"
   }
-}
+}

build-tools/oss-attribution/oss-attribution-generator/package.json

@@ -6547,7 +6547,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ******************************
 
 tar
-7.5.16 <https://github.com/isaacs/node-tar>
+7.5.22 <https://github.com/isaacs/node-tar>
 # Blue Oak Model License
 
 Version 1.0.0

overrides/LICENSE-THIRD-PARTY

@@ -1,8 +1,8 @@
-Override tar to ^7.5.16 to fix CVE-2026-53655.
+Override tar to ^7.5.19.
 
 @generated
-@generator: scripts/patches/apply-override.sh --patch common/finding-override-tar.diff --override 'direct-dev:tar=^7.5.16' --override 'global:tar=^7.5.16'
-@override-package: tar@^7.5.16
+@generator: scripts/patches/apply-override.sh --patch common/finding-override-tar.diff --override 'direct-dev:tar=^7.5.19' --override 'global:tar=^7.5.19'
+@override-package: tar@^7.5.19
 
 Index: b/package.json
 ===================================================================
@@ -13,7 +13,7 @@ Index: b/package.json
      "source-map-support": "^0.3.2",
      "style-loader": "^3.3.2",
 -    "tar": "^7.5.10",
-+    "tar": "^7.5.16",
++    "tar": "^7.5.19",
      "ts-loader": "^9.5.1",
      "ts-node": "^10.9.1",
      "tsec": "0.2.7",
@@ -23,7 +23,7 @@ Index: b/package.json
      "undici": "^7.28.0",
 -    "ws": "^7.5.11"
 +    "ws": "^7.5.11",
-+    "tar": "^7.5.16"
++    "tar": "^7.5.19"
    },
    "repository": {
      "type": "git",