[🤖 automated] chore(docs): update transitive tar in docs/yarn.lock for HEIHEI-780

[zendesk-heibot]

Note

🤖 This PR was generated by HeiBot from the following prompt:

Use the installed $heibot-opex-dispatch skill to work on exactly one OPEX remediation bundle. Follow the skill's Jira lifecycle, label, capability-routing, bundling, and dry-run rules.

Bundle:

• dispatch_run: https://github.com/zendesk/support-test-deployments/actions/runs/31631457170
• bundle_key: hei-hei|zendesk/laika|main|dependency_update|HEIHEI-780
• team: hei hei
• repository: zendesk/laika
• target_branch: main
• remediation_branch: heibot/opex-dependency-update-heihei-780 (the workflow adds a uniqueness suffix)
• remediation_kind: dependency_update
• ecosystem: npm
• manifest_scope: docs/yarn.lock
• test_profile: default
• Jira keys: [
  "HEIHEI-780"
  ]
• Finding IDs: [
  "get_dependency_issues:zendesk/laika"
  ]
• Remediation candidates: [
  {
  "jira_key": "HEIHEI-780",
  "automation_ready": true,
  "source_tool": "get_dependency_issues",
  "source_url": null,
  "remediation_kind": "dependency_update",
  "repository": "zendesk/laika",
  "target_branch": "main",
  "ecosystem": "npm",
  "manifest_scope": "docs/yarn.lock",
  "package": "tar",
  "vulnerable_component": null,
  "container_images": null,
  "current_version": "7.5.16",
  "target_version": "7.5.19",
  "test_profile": "default",
  "finding_ids": [
  "get_dependency_issues:zendesk/laika"
  ],
  "recommendation": null,
  "location": null,
  "evidence": null,
  "container_remediation_action": null,
  "replacement_image": null,
  "deployment_targets": null,
  "deployment_instructions": null
  }
  ]
• Bundle limits: {
  "max_findings_per_pr": 10,
  "max_packages_per_pr": 5,
  "max_jira_tasks_per_pr": 5,
  "max_active_prs_per_repo": 1
  }
• Jira policy: {
  "project": "HEIHEI",
  "epic": "HEIHEI-705",
  "issue_type": "Task",
  "required_labels": [
  "heibot",
  "opex",
  "opex-triage",
  "automation-ready"
  ],
  "excluded_labels": [
  "needs-info",
  "ready-for-human",
  "wontfix"
  ],
  "eligible_statuses": [
  "Refined",
  "Backlog",
  "To Do"
  ],
  "in_progress_status": "In Progress",
  "blocked_status": "Blocked",
  "preserve_labels": [
  "heibot",
  "opex",
  "opex-triage",
  "automation-ready"
  ],
  "on_pr_open_add_labels": [
  "ready-for-human"
  ],
  "on_blocked_add_labels": [
  "needs-info"
  ]
  }
• Assigned capability: {
  "model": "gpt-5.3-codex",
  "claude_plugin_names": [],
  "specialist_subagents": [],
  "preferred_skills": [],
  "deferred_ci_validation": {
  "allowed": false,
  "require_branch_trigger_match": true,
  "require_exact_manifest_build": true
  },
  "fallback_allowed": true,
  "max_specialist_subagents_per_bundle": 1
  }

This primary HeiBot is assigned to execute the bundle, not to produce another plan. It owns Jira and the PR. Use at most the assigned specialist-subagent limit, and use a specialist only for the matching remediation kind. For every Jira task claimed in write mode, finish with the skill's separate human-readable Jira outcome comment and verify its status and labels; an unsuccessful claimed task must explain what failed and the exact information or human action needed to resume. If the skill is unavailable, stop without writes and report that the dispatch runtime is misconfigured.

---

Summary

• Remediates HEIHEI-780 for bundle hei-hei|zendesk/laika|main|dependency_update|HEIHEI-780.
• Updated transitive npm package tar in docs/yarn.lock from 7.5.16 to 7.5.22 (meets/exceeds required minimum 7.5.19).
• Followed repository-native Yarn update pattern (yarn up -R tar) instead of adding a new pin/override.

Files changed

• https://github.com/zendesk/laika/blob/main/docs/yarn.lock

Validation

• Ran: cd docs && yarn build
• Result: passed

OPEX/Jira lifecycle actions completed

• Revalidated task policy and automation context for HEIHEI-780.
• Claimed task by transitioning to In Progress and posting claim comment with dispatch/bundle metadata.
• Added final human-readable outcome comment (separate from claim comment).
• Verified final Jira state:
  • Status: In Progress
  • Labels preserved: heibot, opex, opex-triage, automation-ready, existing opex-id-*
  • Added label per policy for PR-open flow: ready-for-human

Bundle reconciliation

• Accepted/remediated Jira keys: HEIHEI-780
• Skipped Jira keys: none
• Blocked Jira keys: none
• Findings covered: get_dependency_issues:zendesk/laika
• Capability routing: no specialist subagent used (direct dependency remediation path)

---

Tip

💬 To make additional changes, continue the conversation in the original Slack thread, or trigger a new workflow dispatch with restore-session-from-run-id: 31631457170.