v2.1.1

2.1.1 (2026-04-13)

• fix: prevent symlink path traversal via pre-existing symlinks during tar extraction (9c885e5)
• chore: map npm package links to npmx.dev (#134) (fba303c), closes #134

---

This release is also available on:

• npm package (@latest dist-tag)

v1.10.5

1.10.5 (2026-04-13)

• fix: prevent symlink path traversal via pre-existing symlinks during tar extraction (18def23)

---

This release is also available on:

• npm package (@release-1.x dist-tag)

v2.1.0

What's Changed

• feat: support strip for all archive uncompress by @bytemain in #117

Full Changelog: v2.0.1...v2.1.0

v2.0.1

2.0.1 (2026-01-28)

• fix(security): prevent arbitrary file write via symlink extraction (ce1c013)
• chore: Configure Renovate (#121) (fd321da), closes #121
• chore: fix trust publish (92df8f9)
• test: fix test cases for uncompress stream (#118) (5f281d9), closes #118

---

This release is also available on:

• npm package (@latest dist-tag)

v1.10.4

What's Changed

• fix(security): prevent arbitrary file write via symlink extraction by @fengmk2 in #133

Full Changelog: v1.10.3...v1.10.4

v2.0.0

2.0.0 (2025-08-09)

• fix: impl _final method instead hack pipe event (#114) (ba52b7b), closes #114
• feat: remove pump and raise minimum node to v18 (#113) (8ac1164), closes #113

BREAKING CHANGE

• Drop Node.js < 18 support

Node.js 4 is long EOL, so this PR raises it to 18 as per comment. Node
10 has built-in stream.pipeline and fs.mkdir with recursive
option, which can be used instead of pump (they are the same).

Summary by CodeRabbit

• Chores
• Replaced the external stream piping utility with the native Node.js
  stream API throughout the codebase and tests.
• Updated documentation examples to reflect the new usage of the native
  stream API.
• Replaced external directory creation utilities with native Node.js
  directory creation methods using recursive options.
• Removed obsolete dependencies and increased the minimum required
  Node.js version to 18.0.0.

---

This release is also available on:

• npm package (@latest dist-tag)

v1.10.3

1.10.3 (2025-05-24)

Bug Fixes

• link relative paths for better portability (#111) (2684ca2)

---

This release is also available on:

• npm package (@latest dist-tag)

v1.10.2

1.10.2 (2025-05-22)

Bug Fixes

• should handle ./ relative path (#109) (8e5f04a)

---

This release is also available on:

• npm package (@latest dist-tag)

v1.10.1

1.10.1 (2024-05-23)

Bug Fixes

• support windows directory detect (#106) (122091b)

---

This release is also available on:

• npm package (@latest dist-tag)

v1.10.0

1.10.0 (2023-08-24)

Features

• support uncompressing symlink (#31) (d596d88)

---

This release is also available on:

• npm package (@latest dist-tag)