fix(security): bump basic-ftp to close 4 Dependabot alerts (1 critical) - #229
Merged
Merged
Conversation
…itical basic-ftp 5.1.0 → 5.3.1, closing: #44 critical — path traversal in downloadToDir() #96 high — unbounded multiline control response buffering DoS #89 high — incomplete CRLF injection protection (arbitrary FTP command exec) #91 high — unbounded memory consumption in Client.list() basic-ftp is a deep transitive dependency (puppeteer -> @puppeteer/browsers -> proxy-agent -> pac-proxy-agent -> get-uri -> basic-ftp), never imported directly in this codebase — it's used only if get-uri resolves a proxy auto-config file over an ftp:// URL, which this backend does not configure. Low real-world exposure, but the fix costs nothing: get-uri's own package.json already accepts ^5.0.2, so `npm update basic-ftp` resolves to 5.3.1 (the latest 5.x) within the range the parent package already permits — no new direct dependency, no package.json change, no code touched. Verified: get-uri/proxy-agent/puppeteer all require() cleanly after the bump. NOT fixed here: `npm audit fix` for the remaining ~16 open alerts (extract-zip, jws, lodash, minimatch, path-to-regexp, @trpc/server, picomatch, uuid, and three frontend/@opentelemetry packages) is blocked by a pre-existing, unrelated peer-dependency conflict — this repo runs zod v4 but openai@5.10.2 peer-requires zod v3, so `npm audit fix` refuses to resolve anything without --force. Forcing through that risks silently breaking whatever depends on openai's zod-validated schemas, and isn't safe to do blind. Left as a separate, flagged item rather than forced through. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y9rKLxddothnXEtY6KDziN
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
basic-ftp5.1.0 → 5.3.1, closing 4 open Dependabot alerts including the one critical alert on this repo:downloadToDir()Client.list()basic-ftpis a deep transitive dependency (puppeteer → @puppeteer/browsers → proxy-agent → pac-proxy-agent → get-uri → basic-ftp), never imported directly — it only matters ifget-uriresolves a proxy auto-config file overftp://, which this backend doesn't configure. Low real-world exposure, but free to fix:get-uri's ownpackage.jsonalready permits^5.0.2, sonpm update basic-ftpresolves to 5.3.1 within the range the parent already allows. No new direct dependency, nopackage.jsonchange, no code touched.Verified
get-uri,proxy-agent, andpuppeteerallrequire()cleanly after the bump.Not fixed here (flagged, not forced)
The remaining ~16 alerts (
extract-zip,jws,lodash,minimatch,path-to-regexp,@trpc/server,picomatch,uuid, plus three frontend@opentelemetrypackages) are blocked fromnpm audit fixby a pre-existing, unrelated peer-dependency conflict: this repo runszodv4, butopenai@5.10.2peer-requireszodv3. Forcing through with--forcerisks silently breaking whatever depends onopenai's zod-validated schemas — not safe to do without review, so left as a separate item.Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01Y9rKLxddothnXEtY6KDziN