CyberCoveLLC/threshold-ui
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: 🤖 add override for tmp in electron-app to resolve cve (#3307)

Browse Source
This commit is contained in:
Lisbet Alvarez authored and GitHub committed 2026-06-04 15:24:25 -07:00
1 parent 9aea1a8fd8
commit f80d7ebeb3
6 files changed
+10 -28
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

package.json
+1 -1
View File
@@ -51,7 +51,7 @@
"ember-cli-babel>@babel/runtime": "7.27.6",
"ember-try-config>package-json": "^10.0.1",
"ember-loading>ember-concurrency": "^4.0.0",
"tmp": "^0.2.5",
"tmp": "^0.2.7",
"tar": "^7.5.10",
"nomnom>underscore": "^1.13.8"
},
pnpm-lock.yaml
Generated
+1 -1
View File
@@ -12,7 +12,7 @@ overrides:
ember-cli-babel>@babel/runtime: 7.27.6
ember-try-config>package-json: ^10.0.1
ember-loading>ember-concurrency: ^4.0.0
tmp: ^0.2.5
tmp: ^0.2.7
tar: ^7.5.10
nomnom>underscore: ^1.13.8
pnpm-overrides.md
+1 -1
View File
@@ -12,6 +12,6 @@ These overrides force specific versions of transitive dependencies, primarily fo
| `ember-cli-babel>@babel/runtime` | `7.27.6` | `ember-cli-babel` restricts the version it resolves. | Review when upgrading `ember-cli-babel`; once its `@babel/runtime` range is broad enough, remove and verify the build. |
| `ember-try-config>package-json` | `^10.0.1` | `ember-try-config` pins an older `package-json`. | Check whether a newer `ember-try-config` release widens its `package-json` range to include v10+. |
| `ember-loading>ember-concurrency` | `^4.0.0` | `ember-loading` declares `"ember-concurrency": "^2.0.3"`. | The override and the patch (`patches/ember-loading.patch`) are a pair — the override forces v4 to be installed, the patch updates the source to use v4. Both must be removed together if `ember-loading` ever ships a version that natively supports v4. |
| `tmp` | `^0.2.5` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others) | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`. |
| `tmp` | `^0.2.7` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others) | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`. |
| `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether a newer `ember-electron` brings in versions of `@electron/rebuild` and `cacache` that allow `tar ^7.x`. |
| `nomnom>underscore` | `^1.13.8` | `nomnom` pins `"underscore": "~1.6.0"`. All other consumers already declare ranges that include 1.13.8. | `nomnom@1.8.1` is the last published version and the package is abandoned. `jsonlint` is the actual consumer, currently pinned to `^1.6.3` which still depends on `nomnom`. |
ui/desktop/electron-app/package.json
+2 -1
View File
@@ -51,7 +51,8 @@
"pnpm": {
"overrides": {
"tar": "^7.5.10",
"yauzl": "^3.3.1"
"yauzl": "^3.3.1",
"external-editor>tmp": "^0.2.7"
},
"ignoredBuiltDependencies": [],
"onlyBuiltDependencies": [
ui/desktop/electron-app/pnpm-lock.yaml
Generated
+3 -23
View File
@@ -7,6 +7,7 @@ settings:
overrides:
tar: ^7.5.10
yauzl: ^3.3.1
external-editor>tmp: ^0.2.7
importers:
.:
@@ -2982,13 +2983,6 @@ packages:
}
engines: { node: '>=10' }
os-tmpdir@1.0.2:
resolution:
{
integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==,
}
engines: { node: '>=0.10.0' }
p-cancelable@2.1.1:
resolution:
{
@@ -3821,13 +3815,6 @@ packages:
integrity: sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==,
}
tmp@0.0.33:
resolution:
{
integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==,
}
engines: { node: '>=0.6.0' }
tmp@0.2.7:
resolution:
{
@@ -5558,7 +5545,7 @@ snapshots:
dependencies:
chardet: 0.7.0
iconv-lite: 0.4.24
tmp: 0.0.33
tmp: 0.2.7
extract-zip@2.0.1:
dependencies:
@@ -6230,8 +6217,6 @@ snapshots:
strip-ansi: 6.0.1
wcwidth: 1.0.1
os-tmpdir@1.0.2: {}
p-cancelable@2.1.1: {}
p-defer@1.0.0: {}
@@ -6659,12 +6644,7 @@ snapshots:
tmp: 0.2.7
optional: true
tmp@0.0.33:
dependencies:
os-tmpdir: 1.0.2
tmp@0.2.7:
optional: true
tmp@0.2.7: {}
tn1150@0.1.0:
dependencies:
ui/desktop/electron-app/pnpm-overrides.md
+2 -1
View File
@@ -5,6 +5,7 @@ These overrides force specific versions of transitive dependencies, primarily fo
| Package | Version | Pulled in by | What to check before removing |
|---------|---------|--------------|-------------------------------|
| `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether newer releases of `@electron/rebuild` and `cacache` (brought in via `@electron-forge` and `electron`) allow `tar ^7.x`. |
| `tar` | `^7.5.10` | Both `cacache` (`^16.1.3`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether newer releases of `@electron/rebuild` and `cacache` (brought in via `@electron-forge` and `electron`) allow `tar ^7.x`. |
| `yauzl` | `^3.3.1` | `extract-zip` depends on `yauzl@^2.10.0`. `extract-zip` is used directly by both `electron` and `@electron/packager`. `yauzl@2` is broken on Node 24.16+ (see [electron/electron#51619](https://github.com/electron/electron/issues/51619)). | Remove once both `electron` and `@electron/packager` drop their dependency on `extract-zip`. |
| `external-editor>tmp` | `^0.2.7` | `external-editor` (`^3.1.0`) depends on `tmp@0.0.33`. `@inquirer/editor@3.0.1` uses `external-editor` but dependency is removed in newer versions. | Remove once `@electron-forge/cli` upgrades to use `@inquirer/prompts ^8.5.2` since this version fixes security warnings in `@inquirer/external-editor` and no longer has a downstream dependency on `external-editor`. |