From 3b06bc0a297c9c0094480fb0df28aa6281e64d4e Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 3 Aug 2026 01:21:10 +0000 Subject: [PATCH 1/3] fix: CVE-2026-44705 security vulnerability Automated dependency upgrade by OrbisAI Security --- package.json | 5 +++-- pnpm-lock.yaml | 9 +++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 3aba1616ef..e1d82eb3af 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "pake-cli", "version": "3.15.5", - "description": "๐Ÿคฑ๐Ÿป Turn any webpage into a desktop app with one command. ๐Ÿคฑ๐Ÿป ไธ€้”ฎๆ‰“ๅŒ…็ฝ‘้กต็”Ÿๆˆ่ฝป้‡ๆกŒ้ขๅบ”็”จใ€‚", + "description": "\ud83e\udd31\ud83c\udffb Turn any webpage into a desktop app with one command. \ud83e\udd31\ud83c\udffb \u4e00\u952e\u6253\u5305\u7f51\u9875\u751f\u6210\u8f7b\u91cf\u684c\u9762\u5e94\u7528\u3002", "engines": { "node": ">=18.0.0" }, @@ -92,7 +92,8 @@ "pnpm": { "overrides": { "sharp": "^0.34.5", - "@img/sharp-libvips-darwin-arm64": "1.2.4" + "@img/sharp-libvips-darwin-arm64": "1.2.4", + "tmp": "0.2.6" }, "onlyBuiltDependencies": [ "esbuild", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2648b74eb7..bcb52ff8c0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: sharp: ^0.34.5 '@img/sharp-libvips-darwin-arm64': 1.2.4 + tmp: 0.2.6 importers: @@ -1361,8 +1362,8 @@ packages: tmp-promise@3.0.3: resolution: {integrity: sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==} - tmp@0.2.5: - resolution: {integrity: sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==} + tmp@0.2.6: + resolution: {integrity: sha512-5sJPdPjfI5Kx+qbrDesxkglRBxW//g7hCsqspEjwkewGvBMGIKMOTKzLt1hFVJzyadba3lDUN20O9qhvbQUSTA==} engines: {node: '>=14.14'} token-types@6.1.2: @@ -2593,9 +2594,9 @@ snapshots: tmp-promise@3.0.3: dependencies: - tmp: 0.2.5 + tmp: 0.2.6 - tmp@0.2.5: {} + tmp@0.2.6: {} token-types@6.1.2: dependencies: From 362f2d0f73852bf573452384629f99b4b92ba6db Mon Sep 17 00:00:00 2001 From: Tw93 Date: Sat, 8 Aug 2026 18:23:55 +0800 Subject: [PATCH 2/3] fix: use tmp 0.2.7 and keep package description intact MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Restore the emoji in "description"; the automated patch had re-serialized package.json and escaped it into ๐Ÿคฑ surrogate pairs, which would have shipped to the npm registry. Bump the override to 0.2.7 (latest) instead of 0.2.6, and regenerate pnpm-lock.yaml with a real pnpm install so the lockfile matches the manifest under --frozen-lockfile. --- package.json | 4 ++-- pnpm-lock.yaml | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index e1d82eb3af..10abd09d24 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "pake-cli", "version": "3.15.5", - "description": "\ud83e\udd31\ud83c\udffb Turn any webpage into a desktop app with one command. \ud83e\udd31\ud83c\udffb \u4e00\u952e\u6253\u5305\u7f51\u9875\u751f\u6210\u8f7b\u91cf\u684c\u9762\u5e94\u7528\u3002", + "description": "๐Ÿคฑ๐Ÿป Turn any webpage into a desktop app with one command. ๐Ÿคฑ๐Ÿป ไธ€้”ฎๆ‰“ๅŒ…็ฝ‘้กต็”Ÿๆˆ่ฝป้‡ๆกŒ้ขๅบ”็”จใ€‚", "engines": { "node": ">=18.0.0" }, @@ -93,7 +93,7 @@ "overrides": { "sharp": "^0.34.5", "@img/sharp-libvips-darwin-arm64": "1.2.4", - "tmp": "0.2.6" + "tmp": "0.2.7" }, "onlyBuiltDependencies": [ "esbuild", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bcb52ff8c0..6597eed8b2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,7 +7,7 @@ settings: overrides: sharp: ^0.34.5 '@img/sharp-libvips-darwin-arm64': 1.2.4 - tmp: 0.2.6 + tmp: 0.2.7 importers: @@ -1362,8 +1362,8 @@ packages: tmp-promise@3.0.3: resolution: {integrity: sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==} - tmp@0.2.6: - resolution: {integrity: sha512-5sJPdPjfI5Kx+qbrDesxkglRBxW//g7hCsqspEjwkewGvBMGIKMOTKzLt1hFVJzyadba3lDUN20O9qhvbQUSTA==} + tmp@0.2.7: + resolution: {integrity: sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==} engines: {node: '>=14.14'} token-types@6.1.2: @@ -2594,9 +2594,9 @@ snapshots: tmp-promise@3.0.3: dependencies: - tmp: 0.2.6 + tmp: 0.2.7 - tmp@0.2.6: {} + tmp@0.2.7: {} token-types@6.1.2: dependencies: From 62dc05d1adcfcc948d1fddf48c1bbb5c961c52d3 Mon Sep 17 00:00:00 2001 From: Tw93 Date: Sat, 8 Aug 2026 18:28:03 +0800 Subject: [PATCH 3/3] chore: rebuild dist/cli.js for the tmp override dist/cli.js embeds package.json, so the override change has to ship with the regenerated artifact. --- dist/cli.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dist/cli.js b/dist/cli.js index bedc442886..94ab462ab8 100644 --- a/dist/cli.js +++ b/dist/cli.js @@ -112,7 +112,8 @@ var devDependencies = { var pnpm = { overrides: { sharp: "^0.34.5", - "@img/sharp-libvips-darwin-arm64": "1.2.4" + "@img/sharp-libvips-darwin-arm64": "1.2.4", + tmp: "0.2.7" }, onlyBuiltDependencies: [ "esbuild",