Upgrade tmp to version 0.2.5#1755
Merged
paulfitz merged 4 commits intogristlabs:mainfrom Aug 11, 2025
Merged
Conversation
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.0.33 to 0.2.4. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.0.33...v0.2.4) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
fflorent
changed the base branch from
dependabot/npm_and_yarn/tmp-0.2.4
to
main
1. Also upgrade the type definition 2. Adapt the tests to make it compile
fflorent
force-pushed
the
dependabot/npm_and_yarn/tmp-0.2.4
branch
from
ffbbd4b to
8bdbe6b
Compare
Collaborator
Author
|
Ohoh, that a regression of the library itself! |
fflorent
changed the title
fflorent
force-pushed
the
dependabot/npm_and_yarn/tmp-0.2.4
branch
from
4254ef3 to
42aefe9
Compare
promisifyAll alters the prototype of the passed object, which can lead to errors while executing the test case unitary. Instead use the already imported library tmp-promise
fflorent
force-pushed
the
dependabot/npm_and_yarn/tmp-0.2.4
branch
from
42aefe9 to
8b705e6
Compare
Collaborator
Author
|
I used my patched version to check if that fixes the tests, sounds like it does 🎉 |
fflorent
changed the title
Collaborator
Author
|
The fix has been accepted and a new version has just been released. Ready to be reviewed (if the tests in the CI pass) |
fflorent
commented
Aug 8, 2025
fflorent
moved this from In Progress
to Needs Internal Feedback
in French administration Board
paulfitz
approved these changes
Aug 11, 2025
Member
paulfitz
left a comment
paulfitz
left a comment
There was a problem hiding this comment.
Great, thanks for the cleanup and the work upstream!
github-project-automation
bot
moved this from Needs Internal Feedback
to Done
in French administration Board
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
See #1753
But the tests fail.
It fixes a vulnerability (with a low score): GHSA-52f5-9888-hmc6
EDIT: I also have found that the CI does not pass due to a regression by the
tmplibrary:raszi/node-tmp#309
Proposed solution
tmp, remove use of Bluebirds'promisifyAll(I am not very comfortable with altering the prototype globally) and rather use the already imported librarytmp-promise.Has this been tested?