dirtydishes/islandflow
1
0
Fork 0
Code Issues 2 Pull requests 4 Projects Releases Packages Wiki Activity Actions 1

fix tmp cve override #17

Open
dirtydishes wants to merge 7 commits from lavender/address-cve-tmp@0.2.5 into main
pull from: lavender/address-cve-tmp@0.2.5
merge into: dirtydishes:main
Conversation 0 Commits 7 Files changed 7 +1775 -3
dirtydishes commented 2026-06-01 17:37:43 +00:00
Owner
Copy link

summary

this addresses forgejo issue #15 by moving the root tmp override past the vulnerable range and refreshing the bun lockfile. bun now resolves the electron forge packaging chain to tmp@0.2.7.

validation

bun audit reports no vulnerabilities.

bun why tmp shows external-editor resolving to tmp@0.2.7 through the desktop packaging chain.

bun test passes with 250 tests.

bun run check still reports pre-existing biome organize-import diagnostics in unrelated files, so i left that churn out of this security fix and documented it in docs/turns/2026-06-01-address-tmp-cve.html.

intended effect for end users

users should not see any product behavior change. the intended effect is cleaner dependency posture for desktop packaging and developer installs: the repository lockfile no longer carries the flagged tmp@0.2.5 entry from cve-2026-44705.

## summary this addresses forgejo issue #15 by moving the root `tmp` override past the vulnerable range and refreshing the bun lockfile. bun now resolves the electron forge packaging chain to `tmp@0.2.7`. ## validation `bun audit` reports no vulnerabilities. `bun why tmp` shows `external-editor` resolving to `tmp@0.2.7` through the desktop packaging chain. `bun test` passes with 250 tests. `bun run check` still reports pre-existing biome organize-import diagnostics in unrelated files, so i left that churn out of this security fix and documented it in `docs/turns/2026-06-01-address-tmp-cve.html`. ## intended effect for end users users should not see any product behavior change. the intended effect is cleaner dependency posture for desktop packaging and developer installs: the repository lockfile no longer carries the flagged `tmp@0.2.5` entry from cve-2026-44705.
dirtydishes added 1 commit 2026-06-01 17:37:43 +00:00
fix tmp cve override
Some checks failed
CI / Validate (pull_request) Failing after 1m11s
Details
8ede8cc8f3
dirtydishes added 1 commit 2026-06-02 01:05:52 +00:00
use dev routes types in next env
Some checks failed
CI / Validate (pull_request) Failing after 1m7s
Details
1bf113300d
dirtydishes added 1 commit 2026-06-02 01:14:33 +00:00
fix ci import path for next routes types
Some checks failed
CI / Validate (pull_request) Failing after 1m4s
Details
a60619579b
dirtydishes added 1 commit 2026-06-02 13:06:27 +00:00
docs(general): add June 1 standup summary
Some checks failed
CI / Validate (pull_request) Failing after 1m5s
Details
12b9046894
dirtydishes added 1 commit 2026-06-03 16:31:55 +00:00
docs(general): add June 2 standup summary
Some checks failed
CI / Validate (pull_request) Failing after 1m7s
Details
1125471d8d
dirtydishes added 1 commit 2026-06-04 13:04:14 +00:00
docs(general): add June 3 standup summary
Some checks failed
CI / Validate (pull_request) Failing after 1m4s
Details
a74cf7b034
dirtydishes added 1 commit 2026-06-06 03:35:51 +00:00
resolve pr 45 beads conflict
Some checks failed
CI / Validate (pull_request) Failing after 1m7s
Details
5782235e39
Some checks failed
CI / Validate (pull_request) Failing after 1m7s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin lavender/address-cve-tmp@0.2.5:lavender/address-cve-tmp@0.2.5
git checkout lavender/address-cve-tmp@0.2.5

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git checkout main
git merge --no-ff lavender/address-cve-tmp@0.2.5
git checkout lavender/address-cve-tmp@0.2.5
git rebase main
git checkout main
git merge --ff-only lavender/address-cve-tmp@0.2.5
git checkout lavender/address-cve-tmp@0.2.5
git rebase main
git checkout main
git merge --no-ff lavender/address-cve-tmp@0.2.5
git checkout main
git merge --squash lavender/address-cve-tmp@0.2.5
git checkout main
git merge --ff-only lavender/address-cve-tmp@0.2.5
git checkout main
git merge lavender/address-cve-tmp@0.2.5
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: dirtydishes/islandflow#17
No description provided.
Delete branch "lavender/address-cve-tmp@0.2.5"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?