2 low severity vulnerabilities
- Dominant language
- TypeScript
- Stars
- 11.2k
- Forks
- 325
- PR merge metrics
- No merged PRs in 30d
Description
## Problem Description
Running `npm audit` reports vulnerabilities in the **tmp** dependency, which is indirectly required by `patch-package`.
## Audit Log
# npm audit reporttmp <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
No fix available
node_modules/tmp
patch-package *
Depends on vulnerable versions of tmp
node_modules/patch-package2 low severity vulnerabilities
## Impact
- `patch-package` depends on a vulnerable version of `tmp`.
- No fix is currently available.
- This raises security warnings when installing dependencies.
## Steps to Reproduce
1. Install dependencies with `npm install`
2. Run `npm audit`
3. See the reported vulnerability in `tmp`
## Expected Behavior
- `patch-package` should update the `tmp` dependency to a secure version or provide a workaround.
## Environment
- **Node.js**: 20
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.