CVE-2026-24842 node-tar: Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

[sbouchet]

What does this PR do?

This PR fixes GHSA-34x7-hfp2-rc4v : Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal.
tar version is updated to 7.5.7

What issues does this PR fix?

https://issues.redhat.com/browse/CRW-10039

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

[github-actions]

Click here to review and test in web IDE:

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-648-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-648-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-648-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-648-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-648-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-648-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-648-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-648-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-648-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-648-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-648-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-648-dev-amd64