fix: upgrade basic-ftp to 5.2.0 (CVE-2026-27699)

[anupamme]

Summary

Upgrade basic-ftp from 5.0.5 to 5.2.0 to fix CVE-2026-27699.

Vulnerability

Field	Value
ID	CVE-2026-27699
Severity	CRITICAL
Scanner	trivy
Rule	CVE-2026-27699
File	custom-modules/docs-to-pdf/package-lock.json (dependency: basic-ftp)
Assessment	Present in dependency tree, not confirmed reachable

Description: basic-ftp: basic-ftp: File overwrite due to path traversal

Evidence

Scanner confirmation: trivy rule CVE-2026-27699 flagged this pattern.

Changes

• package.json
• package-lock.json
• custom-modules/docs-to-pdf/package.json
• custom-modules/docs-to-pdf/package-lock.json

Behavior Preservation

The change is scoped to 4 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[github-actions]

😺 Thank you for creating this PR!

Certain labels are needed to open a pull request in the docs-site repo, but it looks like you may not be able to add labels. That's because you either do not have permissions or you are using a fork in your PR. To publish your content to Zowe Docs, follow these steps.

• Use comments to add labels to your pull request. Enter the /labels command in a comment to add the required review, area, and release label types.
  • Example: Enter /labels doc cli V2 to add the review: doc, area: cli, and version: V2 labels to your PR.
    • The review label indicates the kind of review your content requires. The area label indicates the content topic area. The release labels tells us the major release aligned with your content.
    • See the docs-site labels to see the labels are available for use.
  • To remove a label, use the minus sign: /labels -V2
• Select the master branch if your PR updates content that is on the live site. Select docs-staging if your PR updates content for a future release. Use the v3-doc-branch for Zowe V3 content.
• Notify the Doc Squad about this PR. If you don't know whom should review your content, message the #zowe-doc Slack channel. If you know which Doc Squad writer should approve your content, add that person as a reviewer.

Need help? Contact the Doc Squad in the #zowe-doc Slack channel.

[github-actions]

📁 The PR description is missing the file name(s) for the updated content. List all the files included in this PR so this information displays in our Zowe Docs GitHub Slack channel.

If you have addressed this issue already, refresh this page in your browser to remove this comment.

[github-actions]

📌 The subject area label is missing. Add an area: label so we know what your content is about.

If you have addressed this issue already, refresh this page in your browser to remove this comment.

[github-actions]

🔍 The review label is missing. Add a review: label so we can determine who needs to approve this PR.

If you have addressed this issue already, refresh this page in your browser to remove this comment.

[github-actions]

💾 The release label is missing. Add a release: label so your content is published with the correct major Zowe release.

If you have addressed this issue already, refresh this page in your browser to remove this comment.