John Smith 2be06d7a34 fix: patch decompress@4.2.1 for CVE-2026-53486 path traversal ...

Upstream decompress is unmaintained (last release 4.2.1). The fix
is in the maintained fork @xhmikosr/decompress, but its API is
incompatible with bin-build@3.0.0 (the dep chain tauri > optipng-bin
> bin-build > decompress).

Apply pnpm's local-patch mechanism to backport the fix to 4.2.1:
- Replace indexOf prefix check with path.relative
- Strip setuid/setgid/sticky bits from extracted file modes
- Resolve and validate symlink/hardlink targets before creation

Advisory: https://github.com/advisories/GHSA-mp2f-45pm-3cg9

2026-07-24 12:16:55 -04:00

..

decompress@4.2.1.patch

fix: patch decompress@4.2.1 for CVE-2026-53486 path traversal

2026-07-24 12:16:55 -04:00