deps: bump tar-fs to 2.1.4 in release/app (GHSA-8cj5-5rvv-wf4v, GHSA-vj76-c3g6-qr5v)

[katsugtgz]

Updates tar-fs to address GHSA-8cj5-5rvv-wf4v and GHSA-vj76-c3g6-qr5v.

Evidence:

• release/app/package-lock.json referenced tar-fs@2.1.2
• osv-scanner reported GHSA-8cj5-5rvv-wf4v, GHSA-vj76-c3g6-qr5v before the update
• updated version: tar-fs@2.1.4

Validation:

• osv-scanner --lockfile=release/app/package-lock.json no longer reports those advisories after the update
• npm ci in release/app installs cleanly with the update; tar-fs@2.1.4 pack/extract roundtrip smoke test passes. The repo's jest setup has no tests in release/app (exits 0 with no tests on this lockfile path).

Note: osv-scanner still reports separate advisories in this lockfile (ws@8.18.0, brace-expansion, and others). This patch only clears the two tar-fs advisories.

Scope: lockfile update only, tar-fs entry in release/app/package-lock.json.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• release/app/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository: requestly/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8aeebfba-e3ec-47af-a322-9089d2a3d9f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}