fix(security): bump basic-ftp to close 4 Dependabot alerts (1 critical) - #229
Merged
Merged
Conversation
…itical basic-ftp 5.1.0 → 5.3.1, closing: #44 critical — path traversal in downloadToDir() #96 high — unbounded multiline control response buffering DoS #89 high — incomplete CRLF injection protection (arbitrary FTP command exec) #91 high — unbounded memory consumption in Client.list() basic-ftp is a deep transitive dependency (puppeteer -> @puppeteer/browsers -> proxy-agent -> pac-proxy-agent -> get-uri -> basic-ftp), never imported directly in this codebase — it's used only if get-uri resolves a proxy auto-config file over an ftp:// URL, which this backend does not configure. Low real-world exposure, but the fix costs nothing: get-uri's own package.json already accepts ^5.0.2, so `npm update basic-ftp` resolves to 5.3.1 (the latest 5.x) within the range the parent package already permits — no new direct dependency, no package.json change, no code touched. Verified: get-uri/proxy-agent/puppeteer all require() cleanly after the bump. NOT fixed here: `npm audit fix` for the remaining ~16 open alerts (extract-zip, jws, lodash, minimatch, path-to-regexp, @trpc/server, picomatch, uuid, and three frontend/@opentelemetry packages) is blocked by a pre-existing, unrelated peer-dependency conflict — this repo runs zod v4 but openai@5.10.2 peer-requires zod v3, so `npm audit fix` refuses to resolve anything without --force. Forcing through that risks silently breaking whatever depends on openai's zod-validated schemas, and isn't safe to do blind. Left as a separate, flagged item rather than forced through. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y9rKLxddothnXEtY6KDziN
github-actions Bot
pushed a commit
that referenced
this pull request
Sep 2, 2026
Three separate sessions have now opened this repo, found the working copy
silently wrong, and spent part of the run repairing it before any real work
could start:
2026-08-29 local main held a commit origin never got, so `git pull --ff-only`
failed for every run entering the repo.
2026-08-31 local main was 2 commits behind origin (#232, #233).
2026-09-02 local main was 3 commits behind (#234-#236), two squash-merged
worktrees were still checked out, and frontend/node_modules
predated the prettier devDependency from #233 — so the first gate
of `npm run verify` died on "prettier: not found".
A bare `git status` reports "clean" in all three cases, which is why each run
rediscovers it the hard way instead of inheriting the last one's fix. Per the
never-twice rule, the third instance gets the automation, not a fourth repair.
`npm run preflight` checks the three invisible ones — divergence from origin
(after an explicit fetch), merged worktree branches still checked out (compared
by patch id via `git cherry`, since `git branch --merged` cannot see a squash),
and node_modules older than its lockfile. Read-only by default, exit 1 on drift;
`npm run preflight -- --fix` repairs what it finds and refuses to touch a
worktree with uncommitted changes.
Both paths exercised on this branch: the read-only run caught backend/
node_modules as stale against the #229/#230 security bumps, and --fix
reinstalled it to clean.
Claude-Session: https://claude.ai/code/session_01PtVWdxno5WtK9zYLkrBz3P
Co-authored-by: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
basic-ftp5.1.0 → 5.3.1, closing 4 open Dependabot alerts including the one critical alert on this repo:downloadToDir()Client.list()basic-ftpis a deep transitive dependency (puppeteer → @puppeteer/browsers → proxy-agent → pac-proxy-agent → get-uri → basic-ftp), never imported directly — it only matters ifget-uriresolves a proxy auto-config file overftp://, which this backend doesn't configure. Low real-world exposure, but free to fix:get-uri's ownpackage.jsonalready permits^5.0.2, sonpm update basic-ftpresolves to 5.3.1 within the range the parent already allows. No new direct dependency, nopackage.jsonchange, no code touched.Verified
get-uri,proxy-agent, andpuppeteerallrequire()cleanly after the bump.Not fixed here (flagged, not forced)
The remaining ~16 alerts (
extract-zip,jws,lodash,minimatch,path-to-regexp,@trpc/server,picomatch,uuid, plus three frontend@opentelemetrypackages) are blocked fromnpm audit fixby a pre-existing, unrelated peer-dependency conflict: this repo runszodv4, butopenai@5.10.2peer-requireszodv3. Forcing through with--forcerisks silently breaking whatever depends onopenai's zod-validated schemas — not safe to do without review, so left as a separate item.Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01Y9rKLxddothnXEtY6KDziN