# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Resolve open `tmp` Dependabot alert #225 on github.com/giselles-ai/giselle/security/dependabot.

## Goal (incl. success criteria)

- Alert #225 closes after the bump:
  - GHSA-7c78-jf6q-g5cm (high) — Type-confusion bypass of `_assertPath` allows path traversal via non-string prefix/postfix/template. Affects `>= 0.2.6, < 0.2.7`, patched in `0.2.7`.

## Constraints/Assumptions

- `tmp` is a transitive dev-only dependency. An existing range override pinned `tmp@<0.2.6` → `0.2.6`, which is itself now vulnerable.

## Key decisions

- Update the existing `pnpm.overrides` pin from `"tmp@<0.2.6": "0.2.6"` to `"tmp@<0.2.7": "0.2.7"`.

## State

- Edit applied to root `package.json` `pnpm.overrides`.
- `pnpm install --lockfile-only` updated the lockfile: `tmp@0.2.6` → `tmp@0.2.7`.

## Done

- Updated root `package.json` overrides.
- `pnpm install --lockfile-only` → success; lockfile resolves `tmp@0.2.7`.

## Now

- Awaiting commit and PR.

## Next

- Commit and open a PR. The `license_finder` workflow will auto-commit `docs/packages-license.md` to the PR branch. Dependabot will auto-close alert #225 once merged.

## Open questions (UNCONFIRMED if needed)

- None.

## Working set (files/ids/commands)

- `package.json` (root) — `pnpm.overrides` range pin for `tmp` bumped to `<0.2.7` → `0.2.7`.
- `pnpm-lock.yaml` — regenerated.
- Verification: `pnpm install --lockfile-only`.
