Extracted from the semver-compatible lockfile upgrade PR (commit 4e38676) — packages/mongodb-downloader/src/decompress.ts (new, 52 lines), src/index.ts, package.json.

• Removes decompress + @types/decompress, adds yauzl ^3.4.0 + @types/yauzl.
• New public-ish extractZip() with strip/filter/highWaterMark, plus behavior change: filter now receives a stripped path string instead of a file object, and highWaterMark is now passed through.
• This is a vuln-driven dependency replacement with new code — clearly its own PR (and wants tests).
• Upgrade tar passed 7.5.20