Please describe your issue:
asar 1.0.0 now has updated dependencies without which a high level "Arbitrary File Overwrite" vulnerability is present.
The dependency path to this vulnerability is electron-packager > asar > mksnapshot > decompress-zip and it described here: https://www.npmjs.com/advisories/777
asar 1.0.0 was just updated to remove dependency of mksnapshot so the vulnerability is no longer present in the no longer maintained decompress-zip
馃憢 Thanks for opening your first issue here! If you have a question about using Electron Packager, read the support docs. If you're reporting a 馃悶 bug, please make sure you include steps to reproduce it. Development and issue triage is community-driven, so please be patient and we will get back to you as soon as we can.
To help make it easier for us to investigate your issue, please follow the contributing guidelines.
Yes, I was part of getting asar to 1.0.0. I plan on doing it when I have some free time.
Also, I plan on adding dependabot to this repository, so for future reference to visitors to this repository, issues asking for dependency version updates are not necessary.
Most helpful comment
Also, I plan on adding dependabot to this repository, so for future reference to visitors to this repository, issues asking for dependency version updates are not necessary.