Security: transitive decompress is unmaintained and vulnerable (GHSA-mp2f-45pm-3cg9 / CVE-2026-53486, CVSS 9.1) #29

npm/weval depends on the unmaintained decompress (+ decompress-tar / decompress-unzip), affected by GHSA-mp2f-45pm-3cg9 / CVE-2026-53486 (critical, 9.1) — path traversal, link escape, setuid preservation. No upstream fix; advisory recommends migrating to @xhmikosr/decompress (patched 11.1.3, same API).

PR: #30.