ds300 / ds300/patch-package

2 low severity vulnerabilities

Open
#583 2 comments 8 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
11.2k
Forks
325
PR merge metrics
No merged PRs in 30d

Description

## Problem Description
Running `npm audit` reports vulnerabilities in the **tmp** dependency, which is indirectly required by `patch-package`.

## Audit Log

# npm audit report

tmp <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
No fix available
node_modules/tmp
patch-package *
Depends on vulnerable versions of tmp
node_modules/patch-package

2 low severity vulnerabilities

## Impact
- `patch-package` depends on a vulnerable version of `tmp`.
- No fix is currently available.
- This raises security warnings when installing dependencies.

## Steps to Reproduce
1. Install dependencies with `npm install`
2. Run `npm audit`
3. See the reported vulnerability in `tmp`

## Expected Behavior
- `patch-package` should update the `tmp` dependency to a secure version or provide a workaround.

## Environment
- **Node.js**: 20

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.