Commits on May 27, 2026

1. Reject non-string prefix, postfix, template

   The relative-value guard in `_assertPath` calls `.includes('..')` directly on
   the user-supplied value. When the value is an Array the call checks element
   equality (so `['../escape'].includes('..')` is false), and when the value is
   an arbitrary object a duck-typed `includes` returning false defeats the check
   entirely. In both cases the value is subsequently coerced to a string by
   `Array.prototype.join` inside `_generateTmpName` and by `path.join`, so a
   non-string carrying `../` still produces a path that escapes `tmpdir`.
   
   Tighten `_assertPath` to require `typeof value === 'string'` before the
   substring check, and apply the same type check to `template` ahead of the
   existing `XXXXXX` regex match (otherwise `match` throws on a non-string with
   an unrelated error). The error includes the option name so consumers can see
   which option was wrong.
   
   Adds a `test/GHSA-7c78-jf6q-g5cm-test.js` that exercises array, duck-typed
   object, and primitive (number) inputs across `fileSync`, `dirSync`, and
   `tmpNameSync`, and asserts that valid string inputs are still accepted.
   
   Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>

   

   tonghuaroot committed May 27, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for ce787f3
   • Browse repository at this point

   Copy the full SHA

   ce787f3 View commit details

   Browse the repository at this point in the history

2. Merge commit from fork

   Reject non-string prefix, postfix, template

   

   raszi authored May 27, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 8f24f78
   • Browse repository at this point

   Copy the full SHA

   8f24f78 View commit details

   Browse the repository at this point in the history

3. Bump up the version

   

   raszi committed May 27, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 8ea1f37
   • Browse repository at this point

   Copy the full SHA

   8ea1f37 View commit details

   Browse the repository at this point in the history