deps: update tar-fs to fix CVE-2025-59343

[soinclined]

Description

Resolves Dependabot alert #362 (CVE-2025-59343) - high severity path traversal vulnerability in tar-fs.

Added pnpm override to force tar-fs version 2.1.4 (patched version) instead of the vulnerable 2.1.3. The vulnerable version was being pulled in as a transitive dependency by @remix-run/dev.

Test plan

• Verified tar-fs version updated from 2.1.3 to 2.1.4 in pnpm-lock.yaml
• All existing tests pass (48 tests across 11 packages)
• Lint checks pass with no errors
• No breaking changes expected (patch-level security fix)

Package updates

• tar-fs: 2.1.3 → 2.1.4 (security patch via pnpm override)

---

Link to Devin run: https://app.devin.ai/sessions/ae745e25423b4e3693564324ee5bffa9
Requested by: Penelope (@soinclined)

[devin-ai-integration]

Original prompt from Penelope

Look into this dependabot and see what we can do to resolve the dependency without breaking anything else 

https://github.com/Paella-Labs/crossbit-main/security/dependabot/591

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 516ccb5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
crossmint-sdk-quickstart-devkit	Ready	Preview	Comment	Oct 7, 2025 4:02pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
smart-wallet-auth-demo	Ignored			Oct 7, 2025 4:02pm