build(deps): bump @xhmikosr/decompress and hugo-bin in /tests/integration/__fixtures__/hugo-site

[dependabot]

Bumps @xhmikosr/decompress to 11.1.4 and updates ancestor dependency hugo-bin. These dependencies need to be updated together.

Updates @xhmikosr/decompress from 8.0.0 to 11.1.4

Release notes

Sourced from @​xhmikosr/decompress's releases.

v11.1.4

Security

Fixes a path-traversal escape (bypass of GHSA-mp2f-45pm-3cg9) where a chain of symlink entries lets an archive write/read files outside the output directory, potentially leading to RCE.

Affected: <= 11.1.3

• Resolve link/directory targets with realpath before the containment check
• Re-validate created symlinks resolve inside the output dir (catches self-referential chains)
• Refuse hardlinks that target a symlink
• Write files with O_NOFOLLOW
• Reject duplicate entry paths

Advisory: GHSA-hrh2-vp3x-79xf

Full changelog: XhmikosR/decompress@v11.1.3...v11.1.4

v11.1.3

Security

Fixes a crafted archive being able to read or write files outside the extraction directory:

• Validate symlink and hardlink targets against the output directory
• Replace the prefix-based containment check with path.relative, fixing a sibling-directory bypass
• Strip setuid, setgid, and sticky bits from extracted files

Advisory: GHSA-mp2f-45pm-3cg9 (CVE-2026-53486)

Other changes

• Write regular files before hardlinks so a hardlink to an extracted file resolves
• Internal refactoring of the extraction code

Full changelog: XhmikosR/decompress@v11.1.2...v11.1.3

v11.1.2

What's Changed

• refactor: migrate internal promise chains to async/await by @​XhmikosR in XhmikosR/decompress#5

Full Changelog: XhmikosR/decompress@v11.1.1...v11.1.2

v10.2.2

Security

10.x backport of the 11.1.4 path-traversal fix (bypass of GHSA-mp2f-45pm-3cg9) - a symlink chain could write/read files outside the output directory, potentially leading to RCE.

Affected: <= 10.2.1

• Resolve link/directory targets with realpath before the containment check

... (truncated)

Commits

• 18aacc5 11.1.4
• 9651c32 Reject duplicate entry paths
• d761266 Write extracted files with O_NOFOLLOW
• 8009c1b Refuse hardlinks that target a symlink
• f6c88c6 Validate created symlinks resolve inside the output directory
• 3cfff38 Use native fs.realpath for containment checks
• dadb5fe npm audit fix
• 005692c Update @xhmikosr/decompress-tar to v9.0.2
• f8c1a2c Reject unsafe entry paths during extraction
• 8c024ab Update c8
• Additional commits viewable in compare view

Updates hugo-bin from 0.108.0 to 0.165.0

Release notes

Sourced from hugo-bin's releases.

v0.161.0

What's Changed

• Breaking: drop Node.js < 22 support
• Update Hugo to v0.164.0
• Add macOS .pkg installer support (#198)
• This release should work on arm64 regardless of the OS

Full Changelog: fenneclab/hugo-bin@v0.149.2...v0.161.0

v0.149.2

No release notes provided.

v0.123.0

What's Changed

• Update dependencies and drop Node.js < 18 support by @​XhmikosR in fenneclab/hugo-bin#148
• Update Hugo to v0.126.0

Note that if you still want to keep using Node.js 16 for the time being, you can stick to the previous version and instead set the hugoVersion to the new one, see https://github.com/fenneclab/hugo-bin#options.

With this release we are now down to 98 packages (at the time of the release). When this journey started after v0.30.0, we were at 345 packages, so this is a 71.5% reduction in packages!

Full Changelog: fenneclab/hugo-bin@v0.122.8...v0.123.0

v0.122.7

• Update Hugo to the latest patch version 0.125.6
• Add npm provenance

Full Changelog: fenneclab/hugo-bin@v0.122.5...v0.122.7

v0.122.0

What's Changed

• Allow setting hugo version via env by @​XhmikosR in fenneclab/hugo-bin#149
• Update Hugo to v0.125.0

Full Changelog: fenneclab/hugo-bin@v0.121.1...v0.122.0

v0.121.1

No release notes provided.

v0.118.0

What's Changed

• Update dependencies and drop Node.js < 16 support by @​XhmikosR in fenneclab/hugo-bin#145

Full Changelog: fenneclab/hugo-bin@v0.117.1...v0.118.0

v0.117.1

... (truncated)

Commits

• 4e26465 0.165.0
• 61435e5 0.164.0
• 41bc5d7 Update Hugo to v0.167.0
• f7a4e7d Update devDependencies
• ff1ec27 0.163.0
• 89a532f Update dependencies
• e586c42 Bump the github-actions group across 1 directory with 3 updates (#215)
• 6a128f5 Update Hugo to v0.166.0
• 30b9d27 zizmor: ignore false positives
• a2372de Update README.md
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hugo-bin since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 51b003af-967e-4cfa-bc99-4557fef00ae3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark results

Comparing with a5cb81a

• Dependency count: 1,072 (no change)
• Package size: 422 MB (no change)
• Number of ts-expect-error directives: 345 (no change)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/netlify-cli@8544

commit: d80e9ca