[security] Upstream vulnerability in decompress module

[nothingismagick]

Describe the bug
There is a NPM high severity warning for kevva/decompress which means yarn audit fails on the JS cli - due its being used in the imagemin family of algorithms.

See: https://www.npmjs.com/advisories/1217
Issue here: kevva/decompress#71
Potential mitigation strategy: kevva/decompress#71 (comment)

The discussion is somewhat long-winded - with a variety of opinions on the security implications of the matter. For our usage of this library I am not concerned since the library is only used for downloading known binaries.

Nevertheless, the "high" severity warning is disconcerting and I wanted to publish this opinion so that you are aware that we are aware of it. Updates will be found here on this issue as well as at the wg-security channel on our Discord.

[rajivshah3]

This was fixed in #545 by @not-matthias