# What changed in tmp

> 2 changes in tmp 0.2 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/tmp/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## tmp 0.2

### Security

- tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template (0.2.7) — [security advisory](https://github.com/advisories/GHSA-7C78-JF6Q-G5CM)
- tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape (0.2.6) — [security advisory](https://github.com/advisories/GHSA-PH9P-34F9-6G65)