fix(build): pin tmp >=0.2.6 to resolve GHSA-ph9p-34f9-6g65

[WilliamBerryiii]

Pull Request

Description

Pin transitive tmp dependency to >=0.2.6 via the root overrides block to resolve GHSA-ph9p-34f9-6g65 (CWE-22 arbitrary path traversal via symbolic link, high severity).

tmp@0.2.5 is pulled in transitively through @vscode/vsce@3.9.1 → tmp. Rather than bumping @vscode/vsce (which could carry unrelated breaking changes), the fix uses the repository's existing overrides pattern alongside other pinned transitive deps (basic-ftp, undici, yauzl, etc.).

Related Issue(s)

Resolves the npm Security Audit CI failure observed on recent PRs (e.g. #1497).

Type of Change

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)

Infrastructure & Configuration:

• Security configuration
• Dependency update

Testing

• npm install succeeded; package-lock.json regenerated.

• npm ls tmp --all shows the override is active:

  hve-core@3.3.101
  └─┬ @vscode/vsce@3.9.1
    └── tmp@0.2.6 overridden
  

• npm run audit:npm (audit-ci) → exit code 0, "Passed npm security audit", 0 vulnerabilities across all severities.

Checklist

Required Checks

• Files follow existing naming conventions
• Changes are backwards compatible

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues — tmp@0.2.6 is the upstream-published patched release for GHSA-ph9p-34f9-6g65.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.55%. Comparing base (5b81056) to head (6440712).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1686      +/-   ##
==========================================
- Coverage   85.56%   85.55%   -0.01%     
==========================================
  Files          85       85              
  Lines       12396    12396              
==========================================
- Hits        10607    10606       -1     
- Misses       1789     1790       +1     

Flag	Coverage Δ
pester	83.88% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.