Replace extract-zip with secure yauzl-based extraction

docs/third-party-licenses.json

@@ -160,6 +160,20 @@
         "url": "https://github.com/yargs/yargs-parser",
         "license": "https://github.com/yargs/yargs-parser/blob/main/LICENSE.txt"
     },
+    {
+        "name": "yauzl",
+        "version": "3.4.0",
+        "spdx": "MIT",
+        "url": "https://github.com/thejoshwolfe/yauzl",
+        "license": "https://github.com/thejoshwolfe/yauzl/blob/master/LICENSE"
+    },
+    {
+        "name": "pend",
+        "version": "1.2.0",
+        "spdx": "MIT",
+        "url": "https://github.com/andrewrk/node-pend",
+        "license": "https://github.com/andrewrk/node-pend/blob/master/LICENSE"
+    },
     {
         "name": "@ant-design/icons",
         "version": "5.6.1",

docs/third-party-licenses.md

@@ -23,6 +23,7 @@ Generated for release: 1.70.0
 |lodash|4.18.1|https://github.com/lodash/lodash|https://github.com/lodash/lodash/blob/master/LICENSE|
 |lodash.debounce|4.0.8|https://github.com/lodash/lodash|https://github.com/lodash/lodash/blob/master/LICENSE|
 |node-fetch|3.3.2|https://github.com/node-fetch/node-fetch|https://github.com/node-fetch/node-fetch/blob/master/LICENSE.md|
+|pend|1.2.0|https://github.com/andrewrk/node-pend|https://github.com/andrewrk/node-pend/blob/master/LICENSE|
 |primereact|10.9.7|https://github.com/primefaces/primereact|https://github.com/primefaces/primereact/blob/master/LICENSE.md|
 |react|18.3.1|https://github.com/facebook/react|https://github.com/facebook/react/blob/main/LICENSE|
 |react-dom|18.3.1|https://github.com/facebook/react|https://github.com/facebook/react/blob/main/LICENSE|
@@ -38,3 +39,4 @@ Generated for release: 1.70.0
 |which|6.0.1|https://github.com/npm/node-which|https://github.com/npm/node-which/blob/main/LICENSE|
 |yaml|2.9.0|https://github.com/eemeli/yaml|https://github.com/eemeli/yaml/blob/main/LICENSE|
 |yargs-parser|21.1.1|https://github.com/yargs/yargs-parser|https://github.com/yargs/yargs-parser/blob/main/LICENSE.txt|
+|yauzl|3.4.0|https://github.com/thejoshwolfe/yauzl|https://github.com/thejoshwolfe/yauzl/blob/master/LICENSE|

package.json

@@ -165,7 +165,6 @@
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "7.0.1",
     "eslint-plugin-unused-imports": "^4.4.1",
-    "extract-zip": "^2.0.1",
     "fs-extra": "^11.3.3",
     "jest": "^29.7.0",
     "jest-environment-jsdom": "^29.7.0",

packages/cmsis-common/README.md

@@ -46,9 +46,13 @@ Focused APIs are also available through the documented subpaths in `package.json
 
 ```ts
 import { TextFile } from '@open-cmsis-pack/cmsis-common/text-file';
+import { extractZip } from '@open-cmsis-pack/cmsis-common/extract-zip';
 import { parseYamlToCTreeItem } from '@open-cmsis-pack/cmsis-common/tree-item-yaml-parser';
 ```
 
+`extractZip` rejects entries that escape the destination, symbolic links, unsafe existing paths,
+and archives exceeding configurable entry or uncompressed-size limits.
+
 Array and map prototype extensions are opt-in side effects. Import only the extension required by
 the application:
 

packages/cmsis-common/package.json

@@ -26,6 +26,9 @@
       "error-list": [
         "dist/error-list.d.ts"
       ],
+      "extract-zip": [
+        "dist/extract-zip.d.ts"
+      ],
       "lazy": [
         "dist/lazy.d.ts"
       ],
@@ -107,6 +110,11 @@
       "require": "./dist/error-list.js",
       "default": "./dist/error-list.js"
     },
+    "./extract-zip": {
+      "types": "./dist/extract-zip.d.ts",
+      "require": "./dist/extract-zip.js",
+      "default": "./dist/extract-zip.js"
+    },
     "./lazy": {
       "types": "./dist/lazy.d.ts",
       "require": "./dist/lazy.js",
@@ -234,12 +242,14 @@
     "jsonc-parser": "^3.3.1",
     "lodash": "^4.18.1",
     "sax-ts": "^1.2.13",
-    "yaml": "^2.8.2"
+    "yaml": "^2.8.2",
+    "yauzl": "^3.4.0"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/lodash": "^4.17.24",
     "@types/node": "^22.19.15",
+    "@types/yauzl": "^2.10.3",
     "dedent": "1.7.1",
     "jest": "^29.7.0",
     "ts-jest": "^29.4.6",