You can use Cypress.env() for this.

it.only('Change Password', () => {
  cy.ResetPassAPI(globalThis.data.dradminemail) // this generates a token in DB
  const resetoken = cy.task(
    'queryDb',
    `select _Token from tokens WHERE _Member_Id = 25372 and _Token_Type = "resetPassword" ORDER BY _id DESC LIMIT 1`
  ) // saving the token from DB generate from above
  Cypress.env('token', resetoken)

  cy.request({
    method: 'PATCH',
    url: 'https://xxx/xx/xx/changePasswordWithToken',
    body: {
      confirmPassword: 'xxx',
      password: 'xx',
      token: Cypress.env('token'), //passing the saved token from database
      uid: 1234,
    },
  })
})

You can save it as an alias and then access it later with calling alias or using this keyword within function(){} instead of arrow function () => {}

// use function{} instead of () => {}
it.only('Change Password', function() {
    cy.ResetPassAPI(globalThis.data.dradminemail)
    cy.task(
      'queryDb',
      `select _Token from tokens WHERE _Member_Id = 25372 and _Token_Type = "resetPassword" ORDER BY _id DESC LIMIT 1`,)
      // task returns token so we save it with alias
      .as('resetToken')

    

    cy.request({
      method: 'PATCH',
      url: 'https://xxx/xx/xx/changePasswordWithToken',
      body: {
        confirmPassword: 'xxx',
        password: 'xx',
        token: this.resetToken, 
        uid: 1234,
      },
    })
  })

You have the wrong syntax for cy.task()

Instead of

const resetoken = cy.task(...)

it should be

cy.task(...).then(resetoken => {

Full test:

it('Change Password', () => {
  cy.ResetPassAPI(globalThis.data.dradminemail);
  const query = 'select _Token from tokens WHERE _Member_Id = 25372 and _Token_Type = "resetPassword" ORDER BY _id DESC LIMIT 1';
  cy.task('queryDb', query)
    .then(resetoken => {
      cy.request({
        method: 'PATCH',
        url: 'https://xxx/xx/xx/changePasswordWithToken',
        body: {
          confirmPassword: 'xxx',
          password: 'xx',
          token: resetoken,  
          uid: 1234,
        },
      });
    });
});

You probably don't need the token anywhere else, once the PATCH has been sent.