From 4772747279e7b9b5b49dc26bcd43b7143a949966 Mon Sep 17 00:00:00 2001
From: Tim Clark <tim.clark@nasa.gov>
Date: Mon, 31 Aug 2026 10:57:53 -0400
Subject: [PATCH] add pacote override

---
 CHANGELOG.md | 5 +++++
 package.json | 1 +
 2 files changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fedfba64584..fe466354a3c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Fixed
+
+- **CUMULUS-5455**
+  - Added `pacote` override (`^21.5.1`) to address https://github.com/advisories/GHSA-w4pp-8pjf-rmxw (CVE-2026-9496)
+
 ### Added
 
 - **CUMULUS-5256**
diff --git a/package.json b/package.json
index 336ed30bdb0..6edc89ef9c1 100644
--- a/package.json
+++ b/package.json
@@ -198,6 +198,7 @@
     "minimatch@7": "^7.4.9",
     "minimatch@9": "^9.0.9",
     "minimatch@10": "^10.2.6",
+    "pacote": "^21.5.1",
     "request": {
       "qs": "^6.14.1"
     },