Skip to content

Bump @xhmikosr/decompress from 10.0.1 to 10.2.1 - #2281

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/xhmikosr/decompress-10.2.1
Closed

Bump @xhmikosr/decompress from 10.0.1 to 10.2.1#2281
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/xhmikosr/decompress-10.2.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 7, 2026

Copy link
Copy Markdown
Contributor

Bumps @xhmikosr/decompress from 10.0.1 to 10.2.1.

Release notes

Sourced from @​xhmikosr/decompress's releases.

v10.2.1

Backport the v11.1.3 security fixes to v10.x:

  • Validate symlink and hardlink targets against the output directory
  • Replace the prefix-based containment check with path.relative, fixing a sibling-directory bypass
  • Strip setuid, setgid, and sticky bits from extracted files

Advisory: GHSA-mp2f-45pm-3cg9 (CVE-2026-53486)

Full Changelog: XhmikosR/decompress@v10.2.0...v10.2.1

v10.2.0

What's Changed

Full Changelog: XhmikosR/decompress@v10.1.0...v10.2.0

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 7, 2026
Bumps [@xhmikosr/decompress](https://github.com/XhmikosR/decompress) from 10.0.1 to 10.2.1.
- [Release notes](https://github.com/XhmikosR/decompress/releases)
- [Commits](XhmikosR/decompress@v10.0.1...v10.2.1)

---
updated-dependencies:
- dependency-name: "@xhmikosr/decompress"
  dependency-version: 10.2.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/xhmikosr/decompress-10.2.1 branch from deb92b0 to c325d23 Compare July 7, 2026 18:46
@dependabot @github

dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #2302.

@dependabot dependabot Bot closed this Aug 7, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/xhmikosr/decompress-10.2.1 branch August 7, 2026 03:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants