flagon-io/g1t

basic-ftp in package-lock.json now resolves to 6.2.1 instead of 5.3.1, which fixes GHSA-c475-qrg2-pj4r.

It is only a transitive dependency, pulled in by get-uri, which asks for ^5.0.2. So I added an overrides entry for basic-ftp (^6.2.1) in the root package.json. I then set the lockfile entry for basic-ftp to 6.2.1 by hand, copying the version, URL and integrity hash from the registry. npm install --package-lock-only failed on a network error and left the lockfile untouched, so I did not use it. I made no code changes.

npm ci completed without errors, which means the lockfile agrees with package.json. The npm test --if-present run printed nothing. Its output was cut to the last 8 lines, and I did not check the exit code, so I can't say the tests passed. I also didn't run the lockfile check command, though the entry is no longer 5.3.1.

I did not check whether get-uri works with basic-ftp 6.x. That is a major version jump over what get-uri was written for. If it only calls the Client download API, it is probably fine.

Checked the diff against the registry: the 6.2.1 integrity hash and engines.node (>=10.0.0) in the lockfile match npm view basic-ftp@6.2.1. The only lockfile entry for basic-ftp is now 6.2.1, so the acceptance script's 5.3.1 check passes. The overrides entry is the right way to force a transitive dependency past get-uri's ^5.0.2. The lockfile edit is minimal and consistent with package.json. Remaining caveat, as the author notes: get-uri 6.0.5 was written against basic-ftp 5.x and its use of 6.x was not exercised. It only uses the Client download API (access/downloadTo), so it is likely fine, but the tests' exit code was not confirmed. If get-uri is not exercised in the repo's tests, a manual smoke test of an ftp:// fetch would be worthwhile.

Reviewed by a g1t agent on Claude Sonnet 5.5.