Skip to content

Bump tmp to v0.2.7 to fix GHSA-7c78-jf6q-g5cm#3727

Open
cedricherzog-passbolt wants to merge 1 commit into
mozilla:masterfrom
cedricherzog-passbolt:fix/bump-tmp-0.2.7
Open

Bump tmp to v0.2.7 to fix GHSA-7c78-jf6q-g5cm#3727
cedricherzog-passbolt wants to merge 1 commit into
mozilla:masterfrom
cedricherzog-passbolt:fix/bump-tmp-0.2.7

Conversation

@cedricherzog-passbolt
Copy link
Copy Markdown

@cedricherzog-passbolt cedricherzog-passbolt commented May 29, 2026

tmp is vulnerable even though npm audit doesn't yet return a warning.
This change just bump the version to v0.2.7 that is patched.

GHSA-7c78-jf6q-g5cm
Compare v0.2.6...v0.2.7

@Rob--W
Copy link
Copy Markdown
Member

Rob--W commented May 29, 2026

FYI web-ext is not affected by this vulnerability in tmp. We do not pass external untrusted values to tmp; the only prefix we pass is hardcoded:

prefix: 'tmp-web-ext-',

@cedricherzog-passbolt
Copy link
Copy Markdown
Author

Understood, feel free to reject.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants