Fixed: basic-ftp is pinned to 6.2.2 with an npm override (it comes through og's puppeteer proxy agent). og's tests pass on it.
Upgrade basic-ftp to 6.2.1: fixes GHSA-c475-qrg2-pj4r #104
basic-ftp (npm) has known vulnerabilities with a fix in 6.2.1. Upgrade it to 6.2.1 or later everywhere it is locked, keeping other changes to what the upgrade needs.
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-c475-qrg2-pj4r | high | 5.3.1 | 6.2.1 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) |
Locked in: package-lock.json (5.3.1).
The acceptance checks pass once no lockfile resolves a vulnerable version and the tests still pass. If the fix needs a major upgrade that breaks the build, change the code that depends on it in the same pull request.
Opened by g1t's dependency upkeep. Turn it off for this project on its Security page.
Definition of done
node -e 'const l=require(require('\''path'\'').resolve(process.argv[1]));const hit=Object.entries(l.packages||{}).some(([k,p])=>k.endsWith('\''node_modules/basic-ftp'\'')&&p.version==='\''5.3.1'\'');process.exit(hit?1:0)' 'package-lock.json'passes.npm ci && npm test --if-presentpasses.