From 7b944c6f0d870ecd10ad4254a7cc8d7781587515 Mon Sep 17 00:00:00 2001
From: thedavidweng <95214375+thedavidweng@users.noreply.github.com>
Date: Sat, 13 Jun 2026 01:15:15 -0700
Subject: [PATCH] refactor: replace temp package with Node built-in fs.mkdtemp

The temp package (v0.9.4, last released November 2020) depends on
rimraf@~2.6.2 -> glob@7.2.3 -> inflight@1.0.6, all of which are
deprecated. inflight is also flagged for memory leaks (CWE-772).

The only usage of temp in this project is creating a single temporary
directory via createTempDir, which maps directly to Node's built-in
fs.mkdtemp combined with os.tmpdir.

This removes the temp and @types/temp dependencies entirely, eliminating
the deprecated transitive dependency chain.

fs.mkdtemp has been stable since Node 5.10.0 and util.promisify since
Node 8.0.0, both within the existing engine requirement of >=8.0.0.
The exported createTempDir function signature and return type are
unchanged.
---
 package.json      | 4 +---
 src/temp-utils.ts | 9 ++++++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index c047f1dd..bc04a452 100644
--- a/package.json
+++ b/package.json
@@ -33,14 +33,12 @@
     "debug": "^4.1.1",
     "fs-extra": "^7.0.1",
     "lodash": "^4.17.21",
-    "semver": "^7.6.3",
-    "temp": "^0.9.0"
+    "semver": "^7.6.3"
   },
   "devDependencies": {
     "@types/fs-extra": "^5.0.5",
     "@types/lodash": "^4.17.0",
     "@types/node": "^20.6.0",
-    "@types/temp": "^0.8.34",
     "@typescript-eslint/eslint-plugin": "^5.62.0",
     "@typescript-eslint/parser": "^5.62.0",
     "ava": "^5.1.1",
diff --git a/src/temp-utils.ts b/src/temp-utils.ts
index 10e83eb4..a1f44094 100644
--- a/src/temp-utils.ts
+++ b/src/temp-utils.ts
@@ -1,8 +1,11 @@
-import * as temp from 'temp';
+import { mkdtemp } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
 import { promisify } from 'util';
-temp.track();
 
-const createTempDir = promisify(temp.mkdir);
+const mkdtempAsync = promisify(mkdtemp);
+
+const createTempDir = (prefix: string) => mkdtempAsync(join(tmpdir(), prefix));
 
 export {
   createTempDir