The unmaintained decompress package (<=4.2.1) allows archive extraction outside the target directory. Migrate electron before-pack to the patched @xhmikosr/decompress fork (11.1.3) to resolve Dependabot alert #301.