[skip ci]

Add path traversal and symlink escape protection to prevent malicious
TAR/TGZ archives from writing files outside the extraction directory.

- Add isPathWithinParent() validation function
- Validate all entry paths stay within destination directory
- Validate symlink targets don't escape extraction directory
- Skip malicious entries with warning messages


GHSA-cc8f-xg8v-72m3

pick from
ce1c013

[skip ci]

## <small>1.10.4 (2026-01-28)</small>

* fix: prevent arbitrary file write via symlink extraction (#133) ([8d16c19](8d16c19)), closes [#133](#133)
* chore: add permissions to auto release ([01acc46](01acc46))
* chore: add warnning message ([2368a03](2368a03))
* chore: start 1.x branch ([6f936e0](6f936e0))
* chore: support auto merge queue ([f2344e7](f2344e7))
* chore: typo fix on branch ([41a5eae](41a5eae))

…tar extraction

Add isRealPathSafe() that walks each path segment using lstat to detect
when a pre-existing symlink on disk would cause a file write outside the
extraction directory. This mitigates GHSA-4c3q-x735-j3r5 where a
crafted tar with ordered entries (symlink then file through that symlink)
could escape the destination.

Also extracts createTarBuffer helper to shared test/util.js.

Closes GHSA-4c3q-x735-j3r5

[skip ci]

## <small>1.10.5 (2026-04-13)</small>

* fix: prevent symlink path traversal via pre-existing symlinks during tar extraction ([18def23](18def23))

## Summary
- Replace `var` with `let`/`const` in `isRealPathSafe()` in
`lib/utils.js` to fix 6 eslint `no-var` errors introduced by the
GHSA-4c3q-x735-j3r5 fix.

## Test plan
- [x] `npm run lint` passes with 0 errors