build(deps): bump @xhmikosr/decompress and hugo-bin in /tests/integration/__fixtures__/hugo-site

[dependabot]

Bumps @xhmikosr/decompress to 11.1.3 and updates ancestor dependency hugo-bin. These dependencies need to be updated together.

Updates @xhmikosr/decompress from 8.0.0 to 11.1.3

Release notes

Sourced from @​xhmikosr/decompress's releases.

v11.1.3

Security

Fixes a crafted archive being able to read or write files outside the extraction directory:

• Validate symlink and hardlink targets against the output directory
• Replace the prefix-based containment check with path.relative, fixing a sibling-directory bypass
• Strip setuid, setgid, and sticky bits from extracted files

Advisory: GHSA-mp2f-45pm-3cg9 (CVE-2026-53486)

Other changes

• Write regular files before hardlinks so a hardlink to an extracted file resolves
• Internal refactoring of the extraction code

Full changelog: XhmikosR/decompress@v11.1.2...v11.1.3

v11.1.2

What's Changed

• refactor: migrate internal promise chains to async/await by @​XhmikosR in XhmikosR/decompress#5

Full Changelog: XhmikosR/decompress@v11.1.1...v11.1.2

v10.2.1

Backport the v11.1.3 security fixes to v10.x:

• Validate symlink and hardlink targets against the output directory
• Replace the prefix-based containment check with path.relative, fixing a sibling-directory bypass
• Strip setuid, setgid, and sticky bits from extracted files

Advisory: GHSA-mp2f-45pm-3cg9 (CVE-2026-53486)

Full Changelog: XhmikosR/decompress@v10.2.0...v10.2.1

v10.2.0

What's Changed

• Replace make-dir with fs.mkdir by @​XhmikosR in XhmikosR/decompress#2

Full Changelog: XhmikosR/decompress@v10.1.0...v10.2.0

Commits

• 921c957 11.1.3
• 4a2e46f extractFile: write files before hardlinks
• 44bc4be runPlugins: use Array.flat()
• eab194d refactor: hoist umask and timestamp out of the extraction loop
• 3796c87 Rename variables
• 2612bd5 Settle all entries before propagating a failure
• b7d1726 Resolve the output path once per extraction
• 60b5299 Strip setuid/setgid/sticky bits from extracted files
• 281cefa Validate link targets to prevent escaping the output directory
• aca5aac Fix sibling-prefix path traversal via path.relative
• Additional commits viewable in compare view

Updates hugo-bin from 0.108.0 to 0.161.0

Release notes

Sourced from hugo-bin's releases.

v0.161.0

What's Changed

• Breaking: drop Node.js < 22 support
• Update Hugo to v0.164.0
• Add macOS .pkg installer support (#198)
• This release should work on arm64 regardless of the OS

Full Changelog: fenneclab/hugo-bin@v0.149.2...v0.161.0

v0.149.2

No release notes provided.

v0.123.0

What's Changed

• Update dependencies and drop Node.js < 18 support by @​XhmikosR in fenneclab/hugo-bin#148
• Update Hugo to v0.126.0

Note that if you still want to keep using Node.js 16 for the time being, you can stick to the previous version and instead set the hugoVersion to the new one, see https://github.com/fenneclab/hugo-bin#options.

With this release we are now down to 98 packages (at the time of the release). When this journey started after v0.30.0, we were at 345 packages, so this is a 71.5% reduction in packages!

Full Changelog: fenneclab/hugo-bin@v0.122.8...v0.123.0

v0.122.7

• Update Hugo to the latest patch version 0.125.6
• Add npm provenance

Full Changelog: fenneclab/hugo-bin@v0.122.5...v0.122.7

v0.122.0

What's Changed

• Allow setting hugo version via env by @​XhmikosR in fenneclab/hugo-bin#149
• Update Hugo to v0.125.0

Full Changelog: fenneclab/hugo-bin@v0.121.1...v0.122.0

v0.121.1

No release notes provided.

v0.118.0

What's Changed

• Update dependencies and drop Node.js < 16 support by @​XhmikosR in fenneclab/hugo-bin#145

Full Changelog: fenneclab/hugo-bin@v0.117.1...v0.118.0

v0.117.1

... (truncated)

Commits

• 46e1a99 0.161.0
• 0d7be29 0.161.0-beta.2
• 937d403 Bump the github-actions group with 2 updates (#207)
• 87681d5 Dependabot: add cooldown
• d901c8f CI: move npm dist-tag detection into a script
• aa864be Run npm update
• aba1ba9 package.json: allow fsevents
• aad36f1 0.161.0-beta.1
• 0470d76 Update xo to v4.0.0
• 11d4e0e Use JSON import attributes for package.json (#206)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hugo-bin since your current version.

[github-actions]

📊 Benchmark results

Comparing with 4f58a08

• Dependency count: 1,127 (no change)
• Package size: 379 MB ⬆️ 0.00% increase vs. 4f58a08
• Number of ts-expect-error directives: 358 (no change)