Upgrade tmp package to 0.2.7 - #256
Conversation
|
@DinoChiesa / Maintainers - I am not sure why the |
Hi @akaustav, you should be able to merge the PR without waiting for the checks or if it's somehow blocking, you can re-push to update the branch to re-trigger them. Thanks! |
@kevya-google - Thanks for responding. I am unable to see the 
|
@kevya-google - On a side note, I saw @rakesh-talanki opened PR #265 with another commit bumping Pending checks on @rakesh-talanki's PR #265
|
|
@kevya-google - I was able to make the next change and now I see two successful checks and one pending check on this PR (similar to the checks on @rakesh-talanki's PR #265) without a 
|
Hi, I've manually approved the security scan workflow to run on both #256 and #265. The workflows require approval from a maintainer because these PRs are created using personal forks instead of branches. |
@kevya-google - Thanks for approving the pending check. I'm not a maintainer of this repository and had to use a personal fork, so I can't see the |
PR #256 previously bumped this dependency to 0.2.5, which successfully patched the Symlink vulnerability (CVE-2025-54798). However, the Path Traversal vulnerability (CVE-2026-44705) via prefix/postfix parameters was only recently patched in version 0.2.7. This update bumps the dependency to ^0.2.7 to ensure both CVEs are comprehensively remediated. Test Suite: 91 specs, 0 failures.
It looks like #265 merged by @rakesh-talanki which merged the changes from this PR so you can safely close this now. I don't have a workaround for you apart from contacting repository members to help merge future changes. |
@kevya-google - Understood. Thanks for the update. I am closing this PR because:
@kevya-google - Would you know how to release this fix into the corresponding npm package hosted at the following URL? https://www.npmjs.com/package/apigeetool |
2 participants
Change Summary
This pull request updates the version of the
tmpdependency in thepackage.jsonfile from version^0.0.27to^0.2.7. Among other things, this update includes the fix for the following security problems - as mentioned in issue #255:Commands Used
The following commands were used to create the changes in this PR:
Additional Notes
masterbranch updatedpackage.jsonto version0.16.6but didn't updatepackage-lock.json. Runningnpm isyncspackage-lock.jsonwith the new version. This PR includes that update.^) prefix in semantic versioning only matches patch versions for0.0.xreleases (unlike versions>= 1which match both minor and patch versions). So^0.0.27will not automatically pick up version0.2.5.tmpversion0.2.4, but the second commit on this PR uses the latest0.2.5(published August 8, 2025).tmpversion0.2.6, but the third commit on this PR uses the latest0.2.7(published May 27, 2026).