Pinned version of tempy has vulnerable transitive dependency

[adambullmer]

Looks like tempy is on a strict version 1.0.1 in this project's package.json. As a result, this tree is the maximum version of glob that can be upgraded safely while respecting all the other package's constraints.

├─ root-package
│  └─ semantic-release-monorepo@npm:8.0.2 [0d2e1] (via npm:^8.0.2 [38627])
│     └─ tempy@npm:1.0.1 (via npm:1.0.1)
│        └─ del@npm:6.1.1 (via npm:^6.0.0)
│           └─ rimraf@npm:3.0.2 (via npm:^3.0.2)
│              └─ glob@npm:7.2.3 (via npm:^7.1.3)

The CVE that this version of glob is affected by is CVE-2025-64756.

I'm not sure if there was a technical reason that it was pinned, but at this point there are 2 major version increases for tempy. I haven't exhausted them all but, I have confirmed that if this library upgraded to the latest, this particular CVE would go away. I'd be happy to make a PR to migrate this dependency, but wanted to check first that there wasn't a technical reason for this particular pin.

ETA:

• I looked into the loose 2.0 release of tempy, and the same glob version (by way of the same del version) would be included, so 3.x would be necessary.

[adambullmer]

Had to make a patch to keep my project secure. The API changes are pretty minimal once the dependency is updated

diff --git a/src/git-utils.js b/src/git-utils.js
index d48ff19b2dea2ba7ff1aac707fd1968f524d8095..d137240603c6c741310181174b821b958f2585cd 100644
--- a/src/git-utils.js
+++ b/src/git-utils.js
@@ -2,7 +2,7 @@ import execa from 'execa';
 import { pipeP, split } from 'ramda';
 import fse from 'fs-extra';
 import path from 'path';
-import tempy from 'tempy';
+import { temporaryDirectory } from 'tempy';
 import fileUrl from 'file-url';
 import gitLogParser from 'git-log-parser';
 import pEachSeries from 'p-each-series';
@@ -70,7 +70,7 @@ const gitCommitsWithFiles = async commits => {
  * @return {{cwd: string, repositoryUrl: string}} The path of the repository
  */
 const initGit = async withRemote => {
-  const cwd = tempy.directory();
+  const cwd = temporaryDirectory();
   const args = withRemote
     ? ['--bare', '--initial-branch=master']
     : ['--initial-branch=master'];
@@ -150,7 +150,7 @@ const gitGetCommits = async from => {
  * @param {String} [branch='master'] the branch to initialize.
  */
 const initBareRepo = async (repositoryUrl, branch = 'master') => {
-  const cwd = tempy.directory();
+  const cwd = temporaryDirectory();
   await execa('git', ['clone', '--no-hardlinks', repositoryUrl, cwd], { cwd });
   await gitCheckout(branch, true, { cwd });
   gitCommits(['Initial commit'], { cwd });
@@ -191,7 +191,7 @@ const initGitRepo = async (withRemote, branch = 'master') => {
  * @return {String} The path of the cloned repository.
  */
 const gitShallowClone = (repositoryUrl, branch = 'master', depth = 1) => {
-  const cwd = tempy.directory();
+  const cwd = temporaryDirectory();
 
   execa(
     'git',

[jaspr01]

@pmowrer @adambullmer what's the status here? This will also resolve a vulnerability about brace-expression (sub dependency of tempy)

brace-expansion  4.0.0 - 5.0.4
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/npm/node_modules/brace-expansion

  ├─┬ semantic-release-monorepo@8.0.2
  │ └─┬ tempy@1.0.1
  │   └─┬ del@6.1.1
  │     └─┬ rimraf@3.0.2
  │       └─┬ glob@7.2.3
  │         └─┬ minimatch@3.1.5
  │           └── brace-expansion@1.1.13

[ddusht]

@jaspr01 @adambullmer checkout https://github.com/ddforge/semantic-release-monorepo-filter