`web-ext-run` pins `tmp` bare at `0.2.5`, one patch below the GHSA-ph9p-34f9-6g65 fix

[AlbinoGeek]

Describe the bug

web-ext-run (a dependency of wxt, used for the dev-mode browser launcher) pins tmp as a bare "0.2.5" in its package.json — an exact version, not a caret range. tmp@0.2.5 is affected by GHSA-ph9p-34f9-6g65 (arbitrary file/directory write via symlink in the default tmp dir), fixed in tmp@0.2.6. Because the pin is exact, npm/pnpm/yarn/bun can't resolve past it without a manual override — every wxt consumer currently gets flagged for this on npm audit/bun audit and has to carry an override to clear it.

web-ext-run's own issue tracker is disabled, so filing here since wxt is the umbrella project pulling it in (same pattern as #1949, which covers a different web-ext-run/pino transitive finding).

Ask: widen web-ext-run's tmp dependency to ^0.2.6 (or later) — a manifest-only change, no code impact expected — either directly or by syncing from upstream mozilla/web-ext if it has already moved past this pin.

Reproduction

{
  "name": "foo",
  "private": true,
  "version": "0.0.0",
  "devDependencies": {
    "wxt": "latest"
  }
}

Steps to reproduce

1. npm install
2. npm audit
3. Observe the tmp GHSA-ph9p-34f9-6g65 finding via wxt → web-ext-run → tmp@0.2.5

System Info

System:
  OS: Linux
Binaries:
  Node: 22.x
  npm: 10.x
npmPackages:
  wxt: latest => (pulls web-ext-run, which pins tmp@0.2.5)

Used Package Manager

npm

Validations

• Read the Contributing Guidelines.
• Read the docs.
• Checked there isn't already an issue reporting this — npm audit fails with wxt@>=0.20.6 #1949 and 3 outdated depenencies found #1426 cover different dependencies (pino/fast-redact and deprecated glob/inflight/rimraf respectively), not tmp.
• This is a concrete bug (an unpatched CVE in a pinned transitive dependency), not a Q&A question.
• Reproduction provided above (audit output is the reproducible artifact here, same as npm audit fails with wxt@>=0.20.6 #1949).