Maintenance: pin `lerna` to 8.1.2 due to upstream regression

[dreamorosi]

Summary

While releasing the next upcoming version we discovered that lerna has had a regression that causes the lock file to be mutated in places that should not be.

The issue has already been reported to Lerna by others lerna/lerna#4026

We should pin the version to the last known working one.

Why is this needed?

So that we can carry on with the release by using a known working version.

Which area does this relate to?

Automation

Solution

Pin lerna to 8.1.2 and override the tar dependency so that we don't have any vulnerable package in the lock file.

Acknowledgment

• This request meets Powertools for AWS Lambda (TypeScript) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.