CVE-2025-48387

### Impact
v3.0.8, v2.1.2, v1.16.4 and below

‍
### Patches
Has been patched in 3.0.9, 2.1.3, and 1.16.5

### Workarounds
You can use the ignore option to ignore non files/directories.

```js
 ignore (_, header) {
   // pass files & directories, ignore e.g. symlinks
   return header.type !== 'file' && header.type !== 'directory'
 }
```

### Credit
Thank you Caleb Brown from Google Open Source Security Team for reporting this in detail.