fix: patch lerna's tar interop bug, fixing GHSA-r292-9mhp-454m

[manojkumar138]

Summary

PR #9542 bumped tar to 7.5.21 to fix GHSA-r292-9mhp-454m (CVSS 7.5 stack-overflow DoS), claiming it was verified safe for lerna's packDirectory usage. That verification was incomplete, and the bump broke the real publish pipeline once merged:

lerna ERR! TypeError: Cannot read properties of undefined (reading 'create')
    at packDirectory (node_modules/lerna/dist/index.js:6429:39)

(failing run)

Root cause: lerna's bundled code does esbuild's __toESM(require('tar')) interop wrapper, then calls .default.create()/.default.list(). tar 7.5.21's CJS build sets __esModule: true but has no actual .default export (only named exports like create/list). esbuild's __toESM only synthesizes a .default fallback when !mod.__esModule — since tar 7.5.21 sets that flag, __toESM leaves .default unset, so it's undefined at runtime. I reproduced lerna's exact __toESM logic in isolation to confirm this precisely, rather than just re-testing bump-and-hope like last time.

Fix: instead of excluding the CVE (which was my first fallback plan — see comment history), this patches the actual bug via patch-package. Both call sites in lerna's dist/index.js become (import_tar.default || import_tar).list(...) and (import_tar2.default || import_tar2).create(...), falling back to the raw module when .default isn't populated. Verified against a byte-for-byte reproduction of lerna's __toESM helper that .default is undefined before the patch and that both .list/.create resolve correctly after it.

This lets us actually take the tar 7.5.21 security fix rather than suppressing the finding.

Ticket

CECHO-1941 (used per request for commit/branch tracking; unrelated to the actual token-onboarding content of that ticket — this is a CI/dependency fix)

Test plan

• patch-package applies cleanly on fresh yarn install
• Reproduced lerna's exact __toESM interop logic standalone — confirmed bug before patch, confirmed fix after
• CI passes
• Release workflow's "Enforce Vulnerability Severity Threshold" and "Lerna Publish" steps both pass on next publish run