Update README.md

[JorisVanEijden]

Document security downside of using this package.
I'm not aware of an easy solution for updating a vulnerable package with this package in place but if someone does it would be good to document that here too.

Edit: Something like

composer require drupal/core:^8.0
composer remove drupal/core-recommended
composer update pear/archive_tar

would work but you'd have to switch back if you want to keep the benefits of core-recommended.

[amansrivastava]

This will solve the issue for the time being.
composer req pear/archive_tar:"1.4.12 as 1.4.11"

[SOMERSOFTAndrewCrook]

In a similar vein
"guzzlehttp/guzzle": "6.5.7 as 6.5.6",
Failure to strip the Cookie header on change in host or HTTP downgrade

[RobinHoutevelts]

https://www.drupal.org/node/3285240

Seems like Drupal 9.5 will allow patch updates on dependencies 🎉