Skip to content

chore(deps): update basic-ftp to 5.3.0#1734

Merged
mschile merged 2 commits intocypress-io:masterfrom
MikeMcC399:update/basic-ftp
Apr 22, 2026
Merged

chore(deps): update basic-ftp to 5.3.0#1734
mschile merged 2 commits intocypress-io:masterfrom
MikeMcC399:update/basic-ftp

Conversation

@MikeMcC399
Copy link
Copy Markdown
Collaborator

@MikeMcC399 MikeMcC399 commented Apr 22, 2026

Situation

npm audit and Dependabot report several high severity vulnerabilities in basic-ftp@5.2.0, a transient dependency of markdown-link-check@3.14.2 (current latest).

$ npm audit
# npm audit report

basic-ftp  <=5.2.2
Severity: high
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands - https://github.com/advisories/GHSA-6v7q-wjvx-w8wg
basic-ftp has FTP Command Injection via CRLF - https://github.com/advisories/GHSA-chqc-8p9q-pq6q
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() - https://github.com/advisories/GHSA-rp42-5vxx-qpwr
fix available via `npm audit fix`
node_modules/basic-ftp

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Change

Execute npm audit fix to update to basic-ftp@5.3.0.


Note

Low Risk
Lockfile-only dependency bump for a dev/transitive package; low risk beyond potential install/CI reproducibility differences.

Overview
Updates the basic-ftp transitive dependency in package-lock.json from 5.2.0 to 5.3.0 (new tarball URL and integrity hash) to pick up upstream security fixes reported by npm audit.

Reviewed by Cursor Bugbot for commit c67512b. Bugbot is set up for automated code reviews on this repo. Configure here.

@MikeMcC399 MikeMcC399 added bug Something isn't working type: dependencies labels Apr 22, 2026
@cypress-app-bot
Copy link
Copy Markdown

@MikeMcC399 MikeMcC399 self-assigned this Apr 22, 2026
@MikeMcC399 MikeMcC399 marked this pull request as ready for review April 22, 2026 09:27
@MikeMcC399 MikeMcC399 requested a review from mschile April 22, 2026 09:27
@mschile mschile merged commit eaec29b into cypress-io:master Apr 22, 2026
87 checks passed
@MikeMcC399 MikeMcC399 deleted the update/basic-ftp branch April 22, 2026 15:02
@github-actions
Copy link
Copy Markdown

🎉 This PR is included in version 7.1.10 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants