[Anber]

Motivation

Three small dev-tooling items, one commit each. They touch only devDependencies, one resolutions entry and pnpm-lock.yaml:

• codecov is a devDependency that nothing calls, and its lockfile entry is marked deprecated.
• del-cli is on 1.1.0 in two manifests; the current major is 8.
• tmp 0.0.33 is reachable from all-contributors-cli and @changesets/cli through inquirer and external-editor. It is affected by GHSA-52f5-9888-hmc6 (tmp up to 0.2.3, low) and GHSA-ph9p-34f9-6g65 (tmp below 0.2.6, high).

Nothing under packages/, examples/ or website/src/ changes, and no script is edited.

Summary

The branch has three commits on top of master. Three files differ from master: package.json, website/package.json and pnpm-lock.yaml.

1. chore(deps): remove the unused codecov devDependency

Removes "codecov": "^3.2.0" from the root package.json, and codecov@3.8.3 from the lockfile together with the 12 packages only it needed.

Why nothing is lost: no workflow step and no script calls it. A case-insensitive search of the tree finds codecov only in that devDependency line, in the lockfile, in the badge links of README.md and in .codecov.yml. The four workflows (check.yml, main.yml, release.yml, site-deploy.yml) have no coverage upload step. The only coverage script, "test:coverage": "turbo run test -- -- --coverage", passes a flag to the tests and does not call the package. The README badge links and .codecov.yml are links and settings for the hosted service, so they stay as they are.

2. chore(deps): update del-cli to v8

del-cli goes from ^1.1.0 to ^8.0.1 in the root package.json and in website/package.json, the same range in both.

• del-cli 8.0.1 was published on 2026-10-09 and is the latest release. It needs Node >=22; the engines floor of the repository is >=22.12.0 and the CI matrix runs 22.x and 24.x. It ships the same two bins, del and del-cli.
• Four scripts call it, all with positional paths only and no flags: the root clean (del 'packages/*/{coverage,dist,esm,lib,types,tsconfig.tsbuildinfo}') and, in website/package.json, clean:client, clean:server and the tail of build:server (del-cli build-jsx). prebuild runs pnpm clean. They run unchanged on del-cli 8, so no script is edited. A search finds no other caller of del or del-cli.
• Lockfile: the 75 keys of the old del-cli 1.1.0 closure (del 3.0.0, meow 3.7.0, update-notifier 2.5.0 and what they pulled in) go, and 13 keys come in: del-cli 8.0.1, del 9.0.1, meow 14.1.0, presentable-error 0.0.1, globby 16.2.4, fast-glob 3.3.3, ignore 7.0.12, is-path-cwd 4.0.1, is-path-inside 4.0.0, p-map 7.1.1, slash 5.1.0, unicorn-magic 0.4.1 and @sindresorhus/merge-streams 4.0.0.
• Release age: every added version was published at least a week before the work (2026-10-22). The youngest is p-map 7.1.1 (2026-10-11); del 9.0.1 is from 2026-10-08 and ignore 7.0.12 from 2026-10-02. ignore 7.0.13 was published on 2026-10-19, so it is not taken: globby 16.2.4 accepts ignore ^7.0.5, and 7.0.12 is the newest allowed version that is old enough.
• Node engines of the added packages: the strictest is >=22 (del-cli and del), which is below the 22.12.0 floor and both CI Node lines.

3. fix(deps): override tmp under external-editor to ^0.2.6

Adds "external-editor>tmp": "^0.2.6" to the root resolutions, next to the two existing entries, and records it in the overrides: header of pnpm-lock.yaml.

• The vulnerable path is all-contributors-cli 6.20.0 > inquirer 7.3.3 > external-editor 3.1.0 > tmp 0.0.33. tmp is declared by external-editor, not by all-contributors-cli: an all-contributors-cli>tmp selector did not match, so the selector names external-editor.
• There is no upgrade that avoids the override. The latest stable all-contributors-cli, 6.26.1, still depends on inquirer ^7.3.3; the only newer release is the prerelease 6.27.0-rc.1, which needs Node >=22.22.0, above the 22.12.0 floor. external-editor 3.1.0 is its latest release and depends on tmp ^0.0.33.
• The override resolves to tmp 0.2.7 (published 2026-05-27), which the lockfile already had, so no new tmp entry is added. tmp 0.0.33 and os-tmpdir 1.0.2 leave the lockfile, and the external-editor@3.1.0 snapshot is the only existing snapshot that changes.
• @changesets/cli also depends on external-editor 3.1.0, so the override repoints its tmp to 0.2.7 as well. This is the same advisory.
• tmp 0.2.7 is outside the ^0.0.33 range that external-editor declares. A round trip through external-editor 3.1.0 on the new tmp (edit('hello') with an editor script that appends a word) returned hello edited, so its use of tmp.fileSync works.

Lockfile scope and audit

• Only these three items change pnpm-lock.yaml. Comparing it with master on the parsed keys: settings are equal; overrides gains only external-editor>tmp; importers change only by the removed codecov entry and the two del-cli entries (specifier ^1.1.0 to ^8.0.1, version 1.1.0 to 8.0.1, root and website); 90 package keys are removed, 13 are added, and no other package changes version.
• Every commit on its own has a consistent lockfile (no orphaned or dangling snapshot), so the branch is bisectable.
• A dependency audit of the lockfile against the npm advisory database goes from 31 vulnerable packages in 39 instances on master to 28 in 35 on the branch. Four vulnerable entries disappear (tmp 0.0.33, trim-newlines 1.0.0, got 6.7.1 and @tootallnate/once 1.1.2) and none appears. The advisory database reports nothing for the 13 added versions or for tmp 0.2.7.
• One new path leads to an entry that was already flagged on master: del-cli > del > globby > fast-glob / micromatch > braces 3.0.3. braces 3.0.3 (a stack exhaustion advisory on deeply nested brace patterns) has no patched release, and many other packages in the lockfile already reach it. Here it is a development tool that deletes fixed literal paths.

Test plan

pnpm 9.15.9 (the version in the root packageManager field) and Node 24.4.1, from the root of the branch:

pnpm install --frozen-lockfile --ignore-scripts
pnpm install --frozen-lockfile --ignore-scripts --strict-peer-dependencies
pnpm exec turbo run build --output-logs=new-only
pnpm typecheck
pnpm test:dts
pnpm test
pnpm lint
pnpm sp:check
pnpm check:all

• All exit 0. The build ran 16 of 16 tasks, including the full website build, so the prebuild clean and the del-cli build-jsx tail of build:server ran on del-cli 8.0.1. typecheck ran 19 of 19 tasks and test:dts 11 of 11; pnpm test ran 11 of 11 with interop 7, core 4, react 22, postcss-linaria 100 and testkit 150 passed (2 skipped).
• The frozen install also passes for each of the three commits on its own: each commit exported into a clean directory and checked with the frozen lockfile in --lockfile-only mode with --strict-peer-dependencies. As a negative control, the manifests of the branch with the lockfile of master fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on the overrides configuration.
• Every script that calls del-cli ran on del-cli 8.0.1 against git-ignored sentinel directories, each exiting 0 with exactly the targets removed: pnpm clean (the dist and esm sentinels of packages/core gone, packages/core/package.json kept; lib, types, coverage and tsconfig.tsbuildinfo of other packages removed as well), pnpm --filter linaria-website clean:client, clean:server, clean (what prebuild runs, on an already clean tree) and exec del-cli build-jsx (the tail of build:server). A real pnpm --filter linaria-website run build:server also exits 0 and leaves no build-jsx.
• grep -n -E '^ tmp@' pnpm-lock.yaml lists only tmp@0.2.7, and pnpm why tmp --recursive shows only 0.2.7, including under external-editor for both all-contributors-cli and @changesets/cli.
• git grep -n -i codecov -- . ':!README.md' ':!.codecov.yml' prints nothing, and after the install no codecov directory is in node_modules/.pnpm.

Not verified

• I have not seen a CI result for this pull request.
• All local runs used Node 24.4.1. I did not run the del-cli scripts on Node 22 or on Windows; the Node 22 support rests on the engines field of del-cli 8.0.1 (>=22) against the 22.12.0 floor, and the scripts only pass plain relative paths and one quoted glob.
• Installs ran with --ignore-scripts, so no lifecycle scripts of the new packages were run.
• tmp 0.2.7 under external-editor was exercised through a direct edit() call only; I did not run the all-contributors or changeset CLIs interactively.
• I did not test the branch merged with any other change; another open change to pnpm-lock.yaml may conflict with it textually.
• The audit counts are those of the advisory database on the day I ran it, so a later run can show more.

Changeset

None. The root package and linaria-website are private, so the published output of the packages does not change.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c5ccc22

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR