Bump tmp to 0.2.7 to address CVE-2026-44705 (#2481) (#2483)

Add yarn resolution "**/tmp": "^0.2.7" to force all transitive
consumers of tmp (currently only cypress) onto the patched
version. Closes CVE-2026-44705 (High) — path traversal in
tmp < 0.2.6 via unsanitized prefix/postfix/dir options.

Mirrors opensearch-project/OpenSearch-Dashboards#12180.


(cherry picked from commit 5200ec1)

Signed-off-by: Nishtha Mittal <nishthamittal04@gmail.com>
Signed-off-by: opensearch-ci-bot <opensearch-infra@amazon.com>
Co-authored-by: Nishtha Mittal <52968976+nishthm@users.noreply.github.com>

Author: opensearch-ci-bot

package.json

@@ -70,6 +70,7 @@
     "bn.js": "^5.2.3",
     "minimatch": "^5.1.7",
     "uuid": ">=14.0.0",
-    "ws": ">=8.20.1"
+    "ws": ">=8.20.1",
+    "**/tmp": "^0.2.7"
   }
 }

yarn.lock

@@ -3369,10 +3369,10 @@ tldts@^6.1.32:
   dependencies:
     tldts-core "^6.1.86"
 
-tmp@^0.2.1, tmp@~0.2.3:
-  version "0.2.5"
-  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.5.tgz#b06bcd23f0f3c8357b426891726d16015abfd8f8"
-  integrity sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==
+tmp@^0.2.1, tmp@^0.2.7, tmp@~0.2.3:
+  version "0.2.7"
+  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059"
+  integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==
 
 to-buffer@^1.2.0, to-buffer@^1.2.1, to-buffer@^1.2.2:
   version "1.2.2"