From f80d7ebeb3d3901ecc458d7e8edd6c047853d003 Mon Sep 17 00:00:00 2001 From: Lisbet Alvarez <107949262+lisbet-alvarez@users.noreply.github.com> Date: Thu, 4 Jun 2026 15:24:25 -0700 Subject: [PATCH] =?UTF-8?q?chore:=20=F0=9F=A4=96=20add=20override=20for=20?= =?UTF-8?q?tmp=20in=20electron-app=20to=20resolve=20cve=20(#3307)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- package.json | 2 +- pnpm-lock.yaml | 2 +- pnpm-overrides.md | 2 +- ui/desktop/electron-app/package.json | 3 ++- ui/desktop/electron-app/pnpm-lock.yaml | 26 +++-------------------- ui/desktop/electron-app/pnpm-overrides.md | 3 ++- 6 files changed, 10 insertions(+), 28 deletions(-) diff --git a/package.json b/package.json index 22e40bb10..89fa5e198 100755 --- a/package.json +++ b/package.json @@ -51,7 +51,7 @@ "ember-cli-babel>@babel/runtime": "7.27.6", "ember-try-config>package-json": "^10.0.1", "ember-loading>ember-concurrency": "^4.0.0", - "tmp": "^0.2.5", + "tmp": "^0.2.7", "tar": "^7.5.10", "nomnom>underscore": "^1.13.8" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c4e3a2156..1bc6b60da 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -12,7 +12,7 @@ overrides: ember-cli-babel>@babel/runtime: 7.27.6 ember-try-config>package-json: ^10.0.1 ember-loading>ember-concurrency: ^4.0.0 - tmp: ^0.2.5 + tmp: ^0.2.7 tar: ^7.5.10 nomnom>underscore: ^1.13.8 diff --git a/pnpm-overrides.md b/pnpm-overrides.md index fb0bc2f90..5c6230efa 100644 --- a/pnpm-overrides.md +++ b/pnpm-overrides.md @@ -12,6 +12,6 @@ These overrides force specific versions of transitive dependencies, primarily fo | `ember-cli-babel>@babel/runtime` | `7.27.6` | `ember-cli-babel` restricts the version it resolves. | Review when upgrading `ember-cli-babel`; once its `@babel/runtime` range is broad enough, remove and verify the build. | | `ember-try-config>package-json` | `^10.0.1` | `ember-try-config` pins an older `package-json`. | Check whether a newer `ember-try-config` release widens its `package-json` range to include v10+. | | `ember-loading>ember-concurrency` | `^4.0.0` | `ember-loading` declares `"ember-concurrency": "^2.0.3"`. | The override and the patch (`patches/ember-loading.patch`) are a pair — the override forces v4 to be installed, the patch updates the source to use v4. Both must be removed together if `ember-loading` ever ships a version that natively supports v4. | -| `tmp` | `^0.2.5` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others) | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`. | +| `tmp` | `^0.2.7` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others) | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`. | | `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether a newer `ember-electron` brings in versions of `@electron/rebuild` and `cacache` that allow `tar ^7.x`. | | `nomnom>underscore` | `^1.13.8` | `nomnom` pins `"underscore": "~1.6.0"`. All other consumers already declare ranges that include 1.13.8. | `nomnom@1.8.1` is the last published version and the package is abandoned. `jsonlint` is the actual consumer, currently pinned to `^1.6.3` which still depends on `nomnom`. | diff --git a/ui/desktop/electron-app/package.json b/ui/desktop/electron-app/package.json index fdfc547c4..4fea0f860 100644 --- a/ui/desktop/electron-app/package.json +++ b/ui/desktop/electron-app/package.json @@ -51,7 +51,8 @@ "pnpm": { "overrides": { "tar": "^7.5.10", - "yauzl": "^3.3.1" + "yauzl": "^3.3.1", + "external-editor>tmp": "^0.2.7" }, "ignoredBuiltDependencies": [], "onlyBuiltDependencies": [ diff --git a/ui/desktop/electron-app/pnpm-lock.yaml b/ui/desktop/electron-app/pnpm-lock.yaml index b54ae6639..929d6a6e7 100644 --- a/ui/desktop/electron-app/pnpm-lock.yaml +++ b/ui/desktop/electron-app/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: tar: ^7.5.10 yauzl: ^3.3.1 + external-editor>tmp: ^0.2.7 importers: .: @@ -2982,13 +2983,6 @@ packages: } engines: { node: '>=10' } - os-tmpdir@1.0.2: - resolution: - { - integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==, - } - engines: { node: '>=0.10.0' } - p-cancelable@2.1.1: resolution: { @@ -3821,13 +3815,6 @@ packages: integrity: sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==, } - tmp@0.0.33: - resolution: - { - integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==, - } - engines: { node: '>=0.6.0' } - tmp@0.2.7: resolution: { @@ -5558,7 +5545,7 @@ snapshots: dependencies: chardet: 0.7.0 iconv-lite: 0.4.24 - tmp: 0.0.33 + tmp: 0.2.7 extract-zip@2.0.1: dependencies: @@ -6230,8 +6217,6 @@ snapshots: strip-ansi: 6.0.1 wcwidth: 1.0.1 - os-tmpdir@1.0.2: {} - p-cancelable@2.1.1: {} p-defer@1.0.0: {} @@ -6659,12 +6644,7 @@ snapshots: tmp: 0.2.7 optional: true - tmp@0.0.33: - dependencies: - os-tmpdir: 1.0.2 - - tmp@0.2.7: - optional: true + tmp@0.2.7: {} tn1150@0.1.0: dependencies: diff --git a/ui/desktop/electron-app/pnpm-overrides.md b/ui/desktop/electron-app/pnpm-overrides.md index e345b8cd5..3af7c1563 100644 --- a/ui/desktop/electron-app/pnpm-overrides.md +++ b/ui/desktop/electron-app/pnpm-overrides.md @@ -5,6 +5,7 @@ These overrides force specific versions of transitive dependencies, primarily fo | Package | Version | Pulled in by | What to check before removing | |---------|---------|--------------|-------------------------------| -| `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether newer releases of `@electron/rebuild` and `cacache` (brought in via `@electron-forge` and `electron`) allow `tar ^7.x`. | +| `tar` | `^7.5.10` | Both `cacache` (`^16.1.3`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether newer releases of `@electron/rebuild` and `cacache` (brought in via `@electron-forge` and `electron`) allow `tar ^7.x`. | | `yauzl` | `^3.3.1` | `extract-zip` depends on `yauzl@^2.10.0`. `extract-zip` is used directly by both `electron` and `@electron/packager`. `yauzl@2` is broken on Node 24.16+ (see [electron/electron#51619](https://github.com/electron/electron/issues/51619)). | Remove once both `electron` and `@electron/packager` drop their dependency on `extract-zip`. | +| `external-editor>tmp` | `^0.2.7` | `external-editor` (`^3.1.0`) depends on `tmp@0.0.33`. `@inquirer/editor@3.0.1` uses `external-editor` but dependency is removed in newer versions. | Remove once `@electron-forge/cli` upgrades to use `@inquirer/prompts ^8.5.2` since this version fixes security warnings in `@inquirer/external-editor` and no longer has a downstream dependency on `external-editor`. |