diff --git a/cli/CHANGELOG.md b/cli/CHANGELOG.md
index 9fd4af4e9..6d641d158 100644
--- a/cli/CHANGELOG.md
+++ b/cli/CHANGELOG.md
@@ -9,6 +9,7 @@ This change log covers only the command line interface (CLI) of Open VSX.
 - Bump fast-uri from `3.1.0` to `3.1.2` ([#1829](https://github.com/eclipse/openvsx/pull/1829))
 - Bump brace-expansion from `5.0.5` to `5.0.6` ([#1846](https://github.com/eclipse/openvsx/pull/1846))
 - Bump qs from `6.15.0` to `6.15.2` ([#1869](https://github.com/eclipse/openvsx/pull/1869))
+- Bump tmp from `0.2.4` to `0.2.6` ([#1877](https://github.com/eclipse/openvsx/pull/1877))
 
 ### [v0.10.12] (08/05/2026)
 
diff --git a/cli/yarn.lock b/cli/yarn.lock
index bf4b4d6a3..f8191b4d0 100644
--- a/cli/yarn.lock
+++ b/cli/yarn.lock
@@ -4241,9 +4241,9 @@ __metadata:
   linkType: hard
 
 "tmp@npm:^0.2.3":
-  version: 0.2.4
-  resolution: "tmp@npm:0.2.4"
-  checksum: 10/6fa6c4e6749824e51cb45f0b050090f0fec6b037cfd327d328ebaf3eae80b7e1a53c6651f9bc36f1fa80cf367ec9dc05067fc1a14034fcfbba96d3a2aaa5c732
+  version: 0.2.6
+  resolution: "tmp@npm:0.2.6"
+  checksum: 10/4ba072821d65f6ec0ae680dd49261bcc66c96a5a463c80ca040747256238aaad68ad5db7aa8367dd1554d22aa77c2988bdb1c5556ecfc4df105f5b73206b7d9b
   languageName: node
   linkType: hard