From f9d499cbf56c077ca37f8b601e57aec8d1b60e9e Mon Sep 17 00:00:00 2001
From: AnujVishwakarma-src
 <298213938+AnujVishwakarma-src@users.noreply.github.com>
Date: Thu, 24 Sep 2026 16:24:57 +0530
Subject: [PATCH] fix: bump yeoman-environment ^4 -> ^6 to clear tar CRITICAL
 (GHSA-23hp-3jrh-7fpw)

tar@6.2.1 (the lone CRITICAL advisory, node-tar DoS, patched >=7.5.19)
remained in the prod tree via yeoman-environment@4.4.3 -> node-gyp@10 ->
tar@6.2.1. Bumping yeoman-environment to ^6 pulls node-gyp@12 -> tar@7.5.22
(patched), removing the advisory (npm audit critical 1 -> 0).

yeoman-environment@6 requires Node >=20.17.0 (its floor is ^20.17.0 || >=22.9.0),
so engines.node is raised from >=20.5.0 to >=20.17.0 to reflect the real minimum
while keeping Node 20/21/22/24 working. The env API used here
(createEnv/instantiate/runGenerator) is unchanged.
---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index a62796c5..9a8aa39d 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "unzipper": "^0.12.5",
     "upath": "^2",
     "which": "^4.0.0",
-    "yeoman-environment": "^4.4.3"
+    "yeoman-environment": "^6.3.0"
   },
   "devDependencies": {
     "@adobe/aio-lib-test-proxy": "^2",
@@ -65,7 +65,7 @@
     "stdout-stderr": "^0.1.9"
   },
   "engines": {
-    "node": ">=20.5.0"
+    "node": ">=20.17.0"
   },
   "files": [
     "bin/run",