Update dependencies (#20)

- @actions/core
- glob
- screeps-api

Reviewed-on: #20
Co-authored-by: Philipp Horstenkamp <philipp@horstenkamp.de>
Co-committed-by: Philipp Horstenkamp <philipp@horstenkamp.de>

node_modules/tar-fs/index.js

@@ -254,6 +254,8 @@ exports.extract = function (cwd, opts) {
     var onsymlink = function () {
       if (win32) return next() // skip symlinks on win for now before it can be tested
       xfs.unlink(name, function () {
+        var dst = path.resolve(path.dirname(name), header.linkname)
+        if (!dst.startsWith(path.resolve(cwd))) return next(new Error(name + ' is not a valid symlink'))
         xfs.symlink(header.linkname, name, stat)
       })
     }

node_modules/tar-fs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tar-fs",
-  "version": "1.16.3",
+  "version": "1.16.4",
   "description": "filesystem bindings for tar-stream",
   "dependencies": {
     "chownr": "^1.0.1",

node_modules/tar-fs/test/index.js

@@ -304,7 +304,7 @@ test('do not extract invalid tar', function (t) {
   fs.createReadStream(a)
     .pipe(tar.extract(out))
     .on('error', function (err) {
-      t.ok(/is not a valid path/i.test(err.message))
+      t.ok(/is not a valid symlink/i.test(err.message))
       fs.stat(path.join(out, '../bar'), function (err) {
         t.ok(err)
         t.end()