chore: 🤖 update tmp package to 0.2.5

[cameronperera]

Description

Test release
This is to resolve a dependabot alert.

Screenshots (if appropriate)

How to Test

Checklist

• I have added before and after screenshots for UI changes
• I have added JSON response output for API changes
• I have added steps to reproduce and test for bug fixes in the description
• I have commented on my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• I have added a11y-tests label to run a11y audit tests if needed

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.
  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
boundary-ui	Ready	Preview	Comment	Nov 19, 2025 11:23pm
boundary-ui-desktop	Ready	Preview	Comment	Nov 19, 2025 11:23pm

[hashicc]

Looks like the test release failed on signing without the right format for the tag.

If you check with pnpm why -r tmp it looks like we still have plenty of tmp versions that are left not upgraded. I think we might need to add a manual resolution to force a later version in the root package.json and one in the electron-app/package.json.

It looks like there weren't any breaking changes in changelog, but the readme has a mention of breaking changes. The breaking changes seem reasonable and likely to not affect us but with the number it's hard to be sure. I think what you did with running the builds and one for the desktop app is the way to go. Given that tmp is a node package it can only really be running within our builds for admin, desktop, or possibly as part of the electron-app but this doesn't look like it's an issue:

devDependencies:
@electron-forge/maker-deb 7.8.1
└─┬ electron-installer-debian 3.2.0
  └─┬ electron-installer-common 0.10.4
    └─┬ tmp-promise 3.0.3
      └── tmp 0.2.5

[cameronperera]

Looks like the test release failed on signing without the right format for the tag.

If you check with pnpm why -r tmp it looks like we still have plenty of tmp versions that are left not upgraded. I think we might need to add a manual resolution to force a later version in the root package.json and one in the electron-app/package.json.

It looks like there weren't any breaking changes in changelog, but the readme has a mention of breaking changes. The breaking changes seem reasonable and likely to not affect us but with the number it's hard to be sure. I think what you did with running the builds and one for the desktop app is the way to go. Given that tmp is a node package it can only really be running within our builds for admin, desktop, or possibly as part of the electron-app but this doesn't look like it's an issue:

devDependencies:
@electron-forge/maker-deb 7.8.1
└─┬ electron-installer-debian 3.2.0
  └─┬ electron-installer-common 0.10.4
    └─┬ tmp-promise 3.0.3
      └── tmp 0.2.5

Thanks for the comment @hashicc. I did not use the -r flag and missed a bunch clearly. I updated the lock files now that I have added the override and will trigger another test build.