From 3f1db72b6b507d2f3497cddbb777fda0947544eb Mon Sep 17 00:00:00 2001 From: Sunita Prajapati Date: Tue, 29 Sep 2026 14:43:50 +0530 Subject: [PATCH] fix(deps): resolve tmp to 0.2.7 to clear path traversal advisory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GHSA-ph9p-34f9-6g65: tmp < 0.2.6 allows path traversal via unsanitized prefix/postfix. Dev/CI tooling only (detox, changesets) — not shipped. Adds two descriptor-scoped resolutions. detox's ^0.2.1 range already admits 0.2.7, but pinning it stops a future `yarn up` sliding back. external-editor's ^0.0.33 needs the override outright: caret on a 0.0.x version pins the patch, so it can never reach the 0.2.x line that carries the fix. Both consumers verified against 0.2.7: - external-editor calls only tmpNameSync(fileOptions), and @changesets/cli constructs ExternalEditor with no arguments, so fileOptions is {} and nothing reaches the new prefix/postfix checks. - detox passes template 'detox--XXXXXX' and setGracefulCleanup(); both still exported, and the template check only requires XXXXXX to appear somewhere in the string. Lockfile collapses to a single tmp@0.2.7 and drops os-tmpdir. Confirmed with yarn why tmp, yarn npm audit (advisory gone), yarn install --immutable, and a require-and-allocate smoke test of each consumer. Co-Authored-By: Claude Opus 5 --- package.json | 2 ++ yarn.lock | 24 ++++-------------------- 2 files changed, 6 insertions(+), 20 deletions(-) diff --git a/package.json b/package.json index 2327be47e..0ad8a9ca4 100644 --- a/package.json +++ b/package.json @@ -98,6 +98,8 @@ "node-gyp@latest": "^13.0.1", "browserslist@^4.20.4": "^4.24.0", "browserslist@^4.22.2": "^4.24.0", + "tmp@^0.2.1": "^0.2.7", + "tmp@^0.0.33": "^0.2.7", "tar": "7.5.20", "baseline-browser-mapping": "2.10.43", "electron-to-chromium": "1.5.393" diff --git a/yarn.lock b/yarn.lock index 4f746e32b..b7950b16b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -14459,13 +14459,6 @@ __metadata: languageName: node linkType: hard -"os-tmpdir@npm:~1.0.2": - version: 1.0.2 - resolution: "os-tmpdir@npm:1.0.2" - checksum: 10c0/f438450224f8e2687605a8dd318f0db694b6293c5d835ae509a69e97c8de38b6994645337e5577f5001115470414638978cc49da1cdcc25106dad8738dc69990 - languageName: node - linkType: hard - "outdent@npm:^0.5.0": version: 0.5.0 resolution: "outdent@npm:0.5.0" @@ -17132,19 +17125,10 @@ __metadata: languageName: node linkType: hard -"tmp@npm:^0.0.33": - version: 0.0.33 - resolution: "tmp@npm:0.0.33" - dependencies: - os-tmpdir: "npm:~1.0.2" - checksum: 10c0/69863947b8c29cabad43fe0ce65cec5bb4b481d15d4b4b21e036b060b3edbf3bc7a5541de1bacb437bb3f7c4538f669752627fdf9b4aaf034cebd172ba373408 - languageName: node - linkType: hard - -"tmp@npm:^0.2.1": - version: 0.2.5 - resolution: "tmp@npm:0.2.5" - checksum: 10c0/cee5bb7d674bb4ba3ab3f3841c2ca7e46daeb2109eec395c1ec7329a91d52fcb21032b79ac25161a37b2565c4858fefab927af9735926a113ef7bac9091a6e0e +"tmp@npm:^0.2.7": + version: 0.2.7 + resolution: "tmp@npm:0.2.7" + checksum: 10c0/59eb55584f2f07210d3231b6a1f6b5c2b9794d8a7b509c8ee867ed2acad6d2245ee2448b7937b676ffbff3155a70077edde8a69f9d7cf0f90c86a62e8910c357 languageName: node linkType: hard