diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f83b4596..7b6ea703 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,7 +7,7 @@ settings:
 overrides:
   '@isaacs/brace-expansion': 5.0.1
   '@types/node': 22.16.5
-  tar: 7.5.8
+  tar: 7.5.11
   zod@4.1.11: 4.1.13
   lodash-es@~4.17: 4.17.23
   qs: 6.14.2
@@ -3610,6 +3610,7 @@ packages:
   '@xmldom/xmldom@0.9.8':
     resolution: {integrity: sha512-p96FSY54r+WJ50FIOsCOjyj/wavs8921hG5+kVMmZgKcvIKxMXHTrjNJvRgWa/zuX3B6t2lijLNFaOyuxUH+2A==}
     engines: {node: '>=14.6'}
+    deprecated: this version has critical issues, please update to the latest version
 
   '@yarnpkg/lockfile@1.1.0':
     resolution: {integrity: sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==}
@@ -7341,8 +7342,8 @@ packages:
     resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==}
     engines: {node: '>=6'}
 
-  tar@7.5.8:
-    resolution: {integrity: sha512-SYkBtK99u0yXa+IWL0JRzzcl7RxNpvX/U08Z+8DKnysfno7M+uExnTZH8K+VGgShf2qFPKtbNr9QBl8n7WBP6Q==}
+  tar@7.5.11:
+    resolution: {integrity: sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==}
     engines: {node: '>=18'}
 
   temp-dir@1.0.0:
@@ -9249,7 +9250,7 @@ snapshots:
       slash: 3.0.0
       ssri: 12.0.0
       string-width: 4.2.3
-      tar: 7.5.8
+      tar: 7.5.11
       temp-dir: 1.0.0
       through: 2.3.8
       tinyglobby: 0.2.12
@@ -10684,7 +10685,7 @@ snapshots:
       picocolors: 1.1.1
       prettier: 3.8.1
       semver: 7.7.4
-      tar: 7.5.8
+      tar: 7.5.11
       temporal-polyfill: 0.3.0
       vscode-languageserver: 9.0.1
       vscode-languageserver-textdocument: 1.0.12
@@ -13278,7 +13279,7 @@ snapshots:
       slash: 3.0.0
       ssri: 12.0.0
       string-width: 4.2.3
-      tar: 7.5.8
+      tar: 7.5.11
       temp-dir: 1.0.0
       through: 2.3.8
       tinyglobby: 0.2.12
@@ -14311,7 +14312,7 @@ snapshots:
       nopt: 9.0.0
       proc-log: 6.1.0
       semver: 7.7.2
-      tar: 7.5.8
+      tar: 7.5.11
       tinyglobby: 0.2.12
       which: 6.0.1
     transitivePeerDependencies:
@@ -14641,7 +14642,7 @@ snapshots:
       promise-retry: 2.0.1
       sigstore: 4.1.0
       ssri: 12.0.0
-      tar: 7.5.8
+      tar: 7.5.11
     transitivePeerDependencies:
       - supports-color
 
@@ -14663,7 +14664,7 @@ snapshots:
       promise-retry: 2.0.1
       sigstore: 4.1.0
       ssri: 13.0.1
-      tar: 7.5.8
+      tar: 7.5.11
     transitivePeerDependencies:
       - supports-color
 
@@ -14685,7 +14686,7 @@ snapshots:
       proc-log: 6.1.0
       sigstore: 4.1.0
       ssri: 13.0.1
-      tar: 7.5.8
+      tar: 7.5.11
     transitivePeerDependencies:
       - supports-color
 
@@ -15695,7 +15696,7 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.2
 
-  tar@7.5.8:
+  tar@7.5.11:
     dependencies:
       '@isaacs/fs-minipass': 4.0.1
       chownr: 3.0.0
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index d57bd6ad..7c21027e 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -25,7 +25,8 @@ minimumReleaseAgeExclude:
   - lodash@4.17.23
   - '@isaacs/brace-expansion@5.0.1'
   - axios@1.13.5
-  - tar@7.5.8
+  # Renovate security update: tar@7.5.11
+  - tar@7.5.8 || 7.5.11
   - qs@6.14.2
   # Renovate security update: ajv@8.18.0
   - ajv@8.18.0
@@ -39,7 +40,7 @@ nodeOptions: ${NODE_OPTIONS:- } --experimental-vm-modules
 overrides:
   '@isaacs/brace-expansion': 5.0.1
   '@types/node': 22.16.5
-  tar: 7.5.8
+  tar: 7.5.11
   zod@4.1.11: 4.1.13
   'lodash-es@~4.17': 4.17.23
   qs: 6.14.2