External/5chan
1
0
Fork 0
mirror of https://github.com/bitsocialnet/5chan.git synced 2026-08-03 07:41:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): replace vulnerable decompress with @xhmikosr/decompress

Browse Source 
The unmaintained decompress package (<=4.2.1) allows archive extraction
outside the target directory. Migrate electron before-pack to the patched
@xhmikosr/decompress fork (11.1.3) to resolve Dependabot alert #301.
This commit is contained in:
Tommaso Casaburi
2026-07-08 21:44:18 +07:00
parent 1e1de76f8f
commit c6dadc6355
3 changed files with 239 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron/before-pack.js
+1 -1
View File
@@ -3,7 +3,7 @@
import fs from 'fs-extra';
import ProgressBar from 'progress';
import https from 'https';
import decompress from 'decompress';
import decompress from '@xhmikosr/decompress';
import path from 'path';
import { fileURLToPath } from 'url';
const ipfsClientsPath = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'bin');