turbo
af6aef88 - fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability (#11622)

Commit
7 days ago
fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability (#11622) ## Summary - Upgrades `inquirer` from 8.2.4 to 8.2.7 across 4 packages: create-turbo, @turbo/workspaces, @turbo/gen, @turbo/codemod - Fixes TURBO-5174: Arbitrary file write via symlink dir parameter in `tmp` package ## Details The vulnerability chain was: `inquirer > external-editor > tmp <=0.2.3` In inquirer 8.2.7, `external-editor` was replaced with `@inquirer/external-editor`, which removes the `tmp` dependency entirely. This is a minor version bump with no breaking API changes. ## Testing - All tests pass for affected packages - All builds succeed
Author
Parents
Loading