fix(deps): bump tar, js-yaml, brace-expansion in /ui [security] (#5413)