fix tmp audit finding #20

Merged

dirtydishes merged 1 commit from lavender/resolve-forgejo-security-issues into main

2026-06-13 06:41:25 +00:00

dirtydishes commented

2026-06-12 23:12:28 +00:00

Owner

summary

this fixes the active tmp <0.2.6 audit finding on current main by raising the root tmp override to ^0.2.6 and refreshing bun.lock to resolve tmp@0.2.7.

validation

bun audit passes with no vulnerabilities found
bun test passes, 250 tests across 41 files
git diff --check -- docs/turns/ package.json bun.lock passes
bun run check still fails on existing biome import-order diagnostics in unrelated source/test files; i left those alone to keep this security pr focused

intended effect for end users

no user-facing behavior should change. the practical effect is a cleaner desktop packaging/tooling dependency graph with the known tmp path traversal advisory removed from the audit output.

notes

this supersedes the older noisy tmp cve branch/pr by rebuilding the fix from current forgejo main in a clean worktree.

summary this fixes the active `tmp <0.2.6` audit finding on current `main` by raising the root `tmp` override to `^0.2.6` and refreshing `bun.lock` to resolve `tmp@0.2.7`. validation - `bun audit` passes with no vulnerabilities found - `bun test` passes, 250 tests across 41 files - `git diff --check -- docs/turns/ package.json bun.lock` passes - `bun run check` still fails on existing biome import-order diagnostics in unrelated source/test files; i left those alone to keep this security pr focused intended effect for end users no user-facing behavior should change. the practical effect is a cleaner desktop packaging/tooling dependency graph with the known `tmp` path traversal advisory removed from the audit output. notes this supersedes the older noisy tmp cve branch/pr by rebuilding the fix from current forgejo `main` in a clean worktree.

dirtydishes added 1 commit 2026-06-12 23:12:29 +00:00