Skip to content

Commit 531fb8c

Browse files
author
Laurent Guitton
committed
chore(deps): override tmp to ^0.2.7 to patch CVE
@vscode/vsce transitively pins tmp 0.2.5, which is affected by a known CVE. Force the resolution via pnpm overrides until upstream bumps its dependency. 🪄 Commit via GitWand
1 parent 13e261f commit 531fb8c

2 files changed

Lines changed: 7 additions & 4 deletions

File tree

‎pnpm-lock.yaml‎

Lines changed: 5 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pnpm-workspace.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,5 @@ allowBuilds:
1111
# pnpm 10+ reads overrides here instead of package.json's "pnpm.overrides"
1212
overrides:
1313
hono: "^4.12.14"
14+
# Security: force tmp >= 0.2.6 (CVE fix). @vscode/vsce pins it lower (0.2.5).
15+
tmp: "^0.2.7"

0 commit comments

Comments
 (0)