Skip to content

Conversation

@Zertz
Copy link
Contributor

@Zertz Zertz commented Aug 7, 2025

[email protected] uses a vulnerable version of tmp and they recommend a global install anyway: https://github.com/sindresorhus/np?tab=readme-ov-file#install

Closes #577

@turi4200
Copy link

turi4200 commented Aug 7, 2025

LGTM

@vavsab
Copy link

vavsab commented Aug 11, 2025

@ds300 @orta Could you please merge this one?

@adstr123
Copy link

@ds300 Please merge, we need to resolve vulnerability

@Zertz
Copy link
Contributor Author

Zertz commented Aug 13, 2025

FWIW, we fixed the issue on our side with npm overrides:

{
    "overrides": {
        "tmp": "0.2.4"
    }
}

@enzoferey
Copy link

Merging this one and publishing a new version would be highly appreciated! 🙏🏻

@VishnuNCS
Copy link

Highly appreciate if this fix can be merge

@andyedwardsibm
Copy link

Given the last release was over 2 years ago, I'm wondering if this package is still maintained...

@ds300 ds300 merged commit f63c2dc into ds300:master Sep 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Vulnerable tmp version

8 participants