[DPEDE-1784](deps): Bump tmp from 0.2.5 to 0.2.7

[dependabot]

Bumps tmp from 0.2.5 to 0.2.7.

Commits

• 8ea1f37 Bump up the version
• 8f24f78 Merge commit from fork
• ce787f3 Reject non-string prefix, postfix, template
• 41f7159 Bump up the version
• efa4a06 Merge commit from fork
• 7ef2728 Check for relative values
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2073/1/. ❌

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Routine patch of tmp 0.2.5→0.2.7 carries no in-repo code impact and fixes one security advisory; escalated solely because critical CI confidence is low (64.3% pass rate across 28 runs on master).

TL;DR

• Merge: 🔍 review, then merge — the dependency itself is fully safe, but critical CI confidence is low on master; confirm the failing workflows are unrelated to this PR before merging.
• Breaks your code? ✅ Most likely not — tmp is not imported anywhere in the repo.
• Security? ✅ this bump fixes GHSA-ph9p-34f9-6g65
• Update: tmp — you have 0.2.5, this PR installs 0.2.7 (patch, spans 2 releases). Fixes 1 advisory (CVE-2026-44705, high); no code changes needed.

Signal	Value	Interpretation
Bump type	patch	z-component changed (0.2.5→0.2.7); patch bumps carry only bug/security fixes — no breaking API changes expected
Dependency risk	low	Patch classification; tmp is not imported anywhere in the repo — zero blast radius; the 0.2.5→0.2.7 changes are path-traversal security fixes, not API breaks
Security risk	low	No advisories still affect 0.2.7: GHSA-ph9p-34f9-6g65 is fixed by this bump; GHSA-7c78-jf6q-g5cm only affected the never-installed intermediate 0.2.6; GHSA-52f5-9888-hmc6 (CVSS 2.5) only affected ≤0.2.3 — neither your installed 0.2.5 nor 0.2.7 was in its range
CI health risk	high	28 critical runs on master: pass rate 64.3% (below 70% threshold), flakiness 0% → low CI confidence. The Push on master workflow (9/9 ✅) and Scheduled (2/2 ✅) are green; failures are concentrated in npm_and_yarn multi-package update workflows for other deps (vite, nuxt). Informational excluded: none
API usage in repo	false	Scanner checked all npm import forms (require('tmp'), import … from 'tmp', dynamic import('tmp'), re-export) — 0 hits; tmp is a transitive dependency only
Cross-repo signal	standalone	No publishable root manifest found at the repo root
Data completeness	complete	All 5 signals obtained (classification, api_usage, release_notes, ci_health, cascade)

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low — pass rate 64.3% across 28 critical runs on master falls below the 70% threshold for medium.

Escalation category: ci-health (a green-dependency PR escalated purely on failing critical checks — not because the dependency is risky).

Confidence breakdown — score: 0.80. Factors:

• ✅ patch bump — conservative semver delta, bug/security fixes only

• ✅ no in-repo usage confirmed by scanner — zero blast radius

• ✅ no advisories affect 0.2.7 — clean on the security axis

• ✅ GHSA-ph9p-34f9-6g65 resolved by this bump (CVE-2026-44705, high)

• ✅ no cascade conflicts — no other open Dependabot PRs for tmp

• ✅ all 5 signals obtained

• ⚠️ critical CI low: pass rate 64.3%, 28 runs — deducted 0.15

• ⚠️ changelog covers pre-0.2.5 releases only (truncated); advisory data confirms 0.2.5→0.2.7 changes are security-only — deducted 0.05

• 💡 To reach a lower route: Raise the critical CI pass rate on master above 70% (→ medium CI, spot_check route) or 90% (→ high CI, potentially auto_eligible). The dependency itself carries no risk — this escalation is purely CI-driven. Fixing informational workflows will NOT change the route; the failing npm_and_yarn multi-package update workflows are the ones counted as critical. Resolving those (or confirming they are not true test/build gates and adjusting classification) will unblock lower routing for future Dependabot PRs.

What AiFEL checked

1. Triage — classified patch (tmp 0.2.5→0.2.7).
2. Symbol extraction — none found (0 import sites; scanner confirmed tmp is not directly used in repo source).
3. Release-notes comparator — changelog covers pre-0.2.5 releases only (truncated); security advisory data confirms the 0.2.5→0.2.7 delta is path-traversal security fixes with no API breaks.
4. CI health — 28 critical runs on master: pass 64.3%, flaky 0% → confidence low; informational excluded: none.
5. Cascade coordinator — no conflicts; no other open Dependabot PRs for tmp.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. tmp is not imported anywhere in the repo (confirmed by scanner), so the 0.2.5→0.2.7 path-traversal security fixes cannot affect any of your source files.

Security advisories

✅ Nothing still affects 0.2.7

✅ Resolved by this bump (1): GHSA-ph9p-34f9-6g65 (CVE-2026-44705, high — CVSS not published) — path traversal via unsanitized prefix/postfix enabling directory escape; affected < 0.2.6, first patched in 0.2.6. Your current 0.2.5 is in the affected range; this bump to 0.2.7 is the fix — no further action needed.

Not applicable to either your installed version or the new version:

• GHSA-7c78-jf6q-g5cm (CVE-2026-49982, CVSS 8.2 high) — type-confusion bypass of _assertPath allowing path traversal via non-string prefix/postfix/template; affected >= 0.2.6, < 0.2.7 only (the never-installed intermediate 0.2.6); first patched in 0.2.7. Your 0.2.5 and this PR's 0.2.7 are both outside the vulnerable range — no exposure, no action needed.
• GHSA-52f5-9888-hmc6 (CVE-2025-54798, CVSS 2.5 low) — arbitrary temporary file/directory write via symlink dir parameter; affected <= 0.2.3, first patched in 0.2.4. Both 0.2.5 and 0.2.7 are outside the affected range — no exposure.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	tmp	0.2.5	0.2.7	Routine patch — fixes GHSA-ph9p-34f9-6g65 (CVE-2026-44705, path traversal); no code changes needed

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "patch",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.80,
  "packages": [{"ecosystem": "npm", "name": "tmp", "old_version": "0.2.5", "new_version": "0.2.7"}],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Patch bump of npm tmp 0.2.5→0.2.7; no in-repo usage; fixes GHSA-ph9p-34f9-6g65 (CVE-2026-44705); escalated due to low CI health (pass rate 64.3%, 28 critical runs).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2073",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience