Upstream decompress is unmaintained (last release 4.2.1). The fix
is in the maintained fork @xhmikosr/decompress, but its API is
incompatible with bin-build@3.0.0 (the dep chain tauri > optipng-bin
> bin-build > decompress).
Apply pnpm's local-patch mechanism to backport the fix to 4.2.1:
- Replace indexOf prefix check with path.relative
- Strip setuid/setgid/sticky bits from extracted file modes
- Resolve and validate symlink/hardlink targets before creation
Advisory: https://github.com/advisories/GHSA-mp2f-45pm-3cg9
John Smith