Security: Fix dependabot alerts for tar, @modelcontextprotocol/sdk, axios packages

[r-farkhutdinov]

No description provided.

[Copilot]

Pull request overview

This pull request addresses security vulnerabilities identified by Dependabot for three packages: tar, @modelcontextprotocol/sdk, and axios. The PR adds or updates package version overrides to force the use of patched versions across the monorepo.

Changes:

• Added override for tar package to enforce version 7.5.7 or higher
• Updated @modelcontextprotocol/sdk override to enforce version 1.26.0 or higher
• Updated axios override from 1.13.2 to 1.13.5

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Added/updated overrides for tar (^7.5.7), @modelcontextprotocol/sdk (^1.26.0), and axios (^1.13.5)
packages/sbom/package.json	Added tar override (^7.5.7) to match root package.json
pnpm-lock.yaml	Updated lockfile with new package versions and their dependencies (axios 1.13.5, tar 7.5.7, @modelcontextprotocol/sdk 1.26.0, @hono/node-server 1.19.9, express-rate-limit 8.2.1, zod-to-json-schema 3.25.1, follow-redirects 1.15.11, ip-address 10.0.1) and removed deprecated/unused versions

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported