Problem Description

Running npm audit reports vulnerabilities in the tmp dependency, which is indirectly required by patch-package.

Audit Log

# npm audit report
tmp <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
No fix available
node_modules/tmp
 patch-package *
 Depends on vulnerable versions of tmp
 node_modules/patch-package
2 low severity vulnerabilities

Impact

• patch-package depends on a vulnerable version of tmp.
• No fix is currently available.
• This raises security warnings when installing dependencies.

Steps to Reproduce

1. Install dependencies with npm install
2. Run npm audit
3. See the reported vulnerability in tmp

Expected Behavior

• patch-package should update the tmp dependency to a secure version or provide a workaround.

Environment

• Node.js: 20