diff --git a/code/build/npm/gyp/package-lock.json b/code/build/npm/gyp/package-lock.json
index 7533caf0666..0ab31fddf55 100644
--- a/code/build/npm/gyp/package-lock.json
+++ b/code/build/npm/gyp/package-lock.json
@@ -1050,9 +1050,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.11.tgz",
-      "integrity": "sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
diff --git a/code/build/npm/gyp/package.json b/code/build/npm/gyp/package.json
index 7276ab0f396..109e07f90d9 100644
--- a/code/build/npm/gyp/package.json
+++ b/code/build/npm/gyp/package.json
@@ -7,7 +7,8 @@
     "node-gyp": "^11.2.0"
   },
   "overrides": {
-    "ip-address": "^10.2.0"
+    "ip-address": "^10.2.0",
+    "tar": "^7.5.22"
   },
   "scripts": {}
 }
diff --git a/code/extensions/copilot/package-lock.json b/code/extensions/copilot/package-lock.json
index 3a3fc30200b..fb731a3e3a4 100644
--- a/code/extensions/copilot/package-lock.json
+++ b/code/extensions/copilot/package-lock.json
@@ -128,7 +128,7 @@
         "shiki": "~1.15.0",
         "sinon": "^21.0.0",
         "source-map-support": "^0.5.21",
-        "tar": "^7.5.16",
+        "tar": "^7.5.22",
         "ts-dedent": "^2.2.0",
         "tsx": "^4.22.4",
         "typescript": "^5.8.3",
@@ -15926,9 +15926,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.16",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
diff --git a/code/extensions/copilot/package.json b/code/extensions/copilot/package.json
index 497ff5f3fac..9796c38d233 100644
--- a/code/extensions/copilot/package.json
+++ b/code/extensions/copilot/package.json
@@ -7183,7 +7183,7 @@
     "shiki": "~1.15.0",
     "sinon": "^21.0.0",
     "source-map-support": "^0.5.21",
-    "tar": "^7.5.16",
+    "tar": "^7.5.22",
     "ts-dedent": "^2.2.0",
     "tsx": "^4.22.4",
     "typescript": "^5.8.3",
diff --git a/code/package-lock.json b/code/package-lock.json
index d93adf0aa52..f3b18f97f93 100644
--- a/code/package-lock.json
+++ b/code/package-lock.json
@@ -178,7 +178,7 @@
         "sinon-test": "^3.1.3",
         "source-map": "0.6.1",
         "source-map-support": "^0.5.21",
-        "tar": "^7.5.16",
+        "tar": "^7.5.22",
         "tsec": "0.2.7",
         "tslib": "^2.6.3",
         "typescript": "^6.0.0-dev.20260416",
@@ -17030,9 +17030,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.16",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
diff --git a/code/package.json b/code/package.json
index 4a2d86c46f1..fd8efab4c6b 100644
--- a/code/package.json
+++ b/code/package.json
@@ -257,7 +257,7 @@
     "sinon-test": "^3.1.3",
     "source-map": "0.6.1",
     "source-map-support": "^0.5.21",
-    "tar": "^7.5.16",
+    "tar": "^7.5.22",
     "tsec": "0.2.7",
     "tslib": "^2.6.3",
     "typescript": "^6.0.0-dev.20260416",
diff --git a/code/remote/package-lock.json b/code/remote/package-lock.json
index a168b8f5a35..42195e3dca6 100644
--- a/code/remote/package-lock.json
+++ b/code/remote/package-lock.json
@@ -50,7 +50,7 @@
         "node-addon-api": "^6.0.0",
         "node-pty": "^1.2.0-beta.13",
         "ssh2": "^1.16.0",
-        "tar": "^7.5.9",
+        "tar": "^7.5.22",
         "tas-client": "0.3.1",
         "vscode-oniguruma": "1.7.0",
         "vscode-regexpp": "^3.1.0",
@@ -2242,9 +2242,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.17",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.17.tgz",
-      "integrity": "sha512-wPEBwzapC+2PaTYPH6e2L+cNOEE227S47wUYFqlegcs8zlLLmeb9Fcff1HVZY4Fwku/1Eyv38n7GYwB2aaS71g==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
diff --git a/code/remote/package.json b/code/remote/package.json
index 176caaaf9ee..b9394dbb17b 100644
--- a/code/remote/package.json
+++ b/code/remote/package.json
@@ -43,7 +43,7 @@
     "node-addon-api": "^6.0.0",
     "node-pty": "^1.2.0-beta.13",
     "ssh2": "^1.16.0",
-    "tar": "^7.5.9",
+    "tar": "^7.5.22",
     "tas-client": "0.3.1",
     "vscode-oniguruma": "1.7.0",
     "vscode-regexpp": "^3.1.0",