What's Changed

• fix(deps): update dependency iconv-lite to ^0.7.0 by @renovate[bot] in #122
• chore(deps): update dependency @types/node to v24 by @renovate[bot] in #123
• fix: replace @eggjs/yauzl with upstream yauzl 3.4.0, update yazl to 3.3.1 by @fengmk2 in #145

Full Changelog: v2.1.2...v2.1.3

What's Changed

• fix: resolve symlink chains fully when extracting by @fengmk2 in #140
• ci: add Node.js 26 to the test matrix by @fengmk2 in #141
• test: use node:crypto randomUUID instead of uuid dependency by @fengmk2 in #143

Full Changelog: v2.1.1...v2.1.2

What's Changed

• chore: replace var with let/const in isRealPathSafe by @fengmk2 in #135
• fix: resolve symlink chains fully when extracting by @fengmk2 in #142

Full Changelog: v1.10.5...v1.10.6

What's Changed

• chore: map npm package links to npmx.dev by @fengmk2 with @Copilot in #134

New Contributors

• @fengmk2 with @Copilot made their first contribution in #134

Full Changelog: v2.1.0...v2.1.1

1.10.5 (2026-04-13)

• fix: prevent symlink path traversal via pre-existing symlinks during tar extraction (18def23)

This release is also available on:

• npm package (@release-1.x dist-tag)

What's Changed

• feat: support strip for all archive uncompress by @bytemain in #117

Full Changelog: v2.0.1...v2.1.0

2.0.1 (2026-01-28)

• fix(security): prevent arbitrary file write via symlink extraction (ce1c013)
• chore: Configure Renovate (#121) (fd321da), closes #121
• chore: fix trust publish (92df8f9)
• test: fix test cases for uncompress stream (#118) (5f281d9), closes #118

This release is also available on:

• npm package (@latest dist-tag)

What's Changed

• fix(security): prevent arbitrary file write via symlink extraction by @fengmk2 in #133

Full Changelog: v1.10.3...v1.10.4

2.0.0 (2025-08-09)

• fix: impl _final method instead hack pipe event (#114) (ba52b7b), closes #114
• feat: remove pump and raise minimum node to v18 (#113) (8ac1164), closes #113

BREAKING CHANGE

• Drop Node.js < 18 support

Node.js 4 is long EOL, so this PR raises it to 18 as per comment. Node
10 has built-in stream.pipeline and fs.mkdir with recursive
option, which can be used instead of pump (they are the same).

Summary by CodeRabbit

• Chores
• Replaced the external stream piping utility with the native Node.js
  stream API throughout the codebase and tests.
• Updated documentation examples to reflect the new usage of the native
  stream API.
• Replaced external directory creation utilities with native Node.js
  directory creation methods using recursive options.
• Removed obsolete dependencies and increased the minimum required
  Node.js version to 18.0.0.

This release is also available on:

• npm package (@latest dist-tag)

1.10.3 (2025-05-24)

Bug Fixes

• link relative paths for better portability (#111) (2684ca2)

This release is also available on:

• npm package (@latest dist-tag)