From b0693781b100e3a69fc59328de77406dd23bddc8 Mon Sep 17 00:00:00 2001
From: kgala2 <galakp@google.com>
Date: Tue, 8 Sep 2026 20:30:40 +0000
Subject: [PATCH] deps: upgrade tmp to ^0.2.4 to resolve CVE-2026-44705 and
 CVE-2025-54798

---
 package-lock.json | 21 ++++-----------------
 package.json      |  3 +++
 2 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index ac6e093e..f15d75de 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8488,16 +8488,6 @@
         "node": ">= 0.8.0"
       }
     },
-    "node_modules/os-tmpdir": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz",
-      "integrity": "sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/outvariant": {
       "version": "1.4.3",
       "resolved": "https://registry.npmjs.org/outvariant/-/outvariant-1.4.3.tgz",
@@ -10813,16 +10803,13 @@
       }
     },
     "node_modules/tmp": {
-      "version": "0.0.33",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz",
-      "integrity": "sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
+      "integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "os-tmpdir": "~1.0.2"
-      },
       "engines": {
-        "node": ">=0.6.0"
+        "node": ">=14.14"
       }
     },
     "node_modules/to-regex-range": {
diff --git a/package.json b/package.json
index ad272b80..ed952779 100644
--- a/package.json
+++ b/package.json
@@ -94,5 +94,8 @@
     "gaxios": "^8.0.0",
     "google-auth-library": "^11.0.2",
     "p-throttle": "^8.1.0"
+  },
+  "overrides": {
+    "tmp": "^0.2.4"
   }
 }