fix(build): pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr

[WilliamBerryiii]

Description

Added an npm overrides entry pinning basic-ftp to 5.3.0 to resolve advisory GHSA-rp42-5vxx-qpwr (unbounded memory consumption in Client.list() — denial of service). The vulnerable package entered the tree transitively via markdown-link-check → proxy-agent → pac-proxy-agent → get-uri → basic-ftp. Using an override matches the existing convention in this repository (the overrides block already pins markdown-it, picomatch, smol-toml, undici, yaml, and yauzl for similar transitive security reasons). After the change, npm audit reports 0 vulnerabilities.

Related Issue(s)

None

Type of Change

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature
• Breaking change
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration
• Security configuration
• DevContainer configuration
• Dependency update

Testing

Agent-run validation:

• npm install --package-lock-only — passed; lockfile regenerated cleanly
• npm audit — passed; 0 vulnerabilities (previously reported GHSA-rp42-5vxx-qpwr)
• npm run lint:dependency-pinning — passed; 100% compliance across 177 dependencies, 0 violations

Manual testing was not performed.

Checklist

Required Checks

• Documentation is updated (if applicable) — N/A, dependency manifest only
• Files follow existing naming conventions
• Changes are backwards compatible
• Tests added for new functionality (if applicable) — N/A, dependency-only fix

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Plugin freshness: npm run plugin:generate
• Docusaurus tests: npm run docs:test

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege — N/A

Additional Notes

• Scope is intentionally minimal: only package.json (one override entry added) and package-lock.json (regenerated) are modified.
• npm audit fix was considered but rejected because it would have pulled in an unrelated optional dependency (@vscode/vsce-sign-alpine-arm64); the explicit override keeps the diff focused and matches the existing repo pattern for transitive security pins.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/basic-ftp	5.3.0	🟢 5.6	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 20 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 SAST ⚠️ 0 no SAST tool detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches

Scanned Files

• package-lock.json

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.65%. Comparing base (3aded28) to head (5377f7f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1374      +/-   ##
==========================================
- Coverage   87.66%   87.65%   -0.02%     
==========================================
  Files          61       61              
  Lines        9328     9328              
==========================================
- Hits         8177     8176       -1     
- Misses       1151     1152       +1     

Flag	Coverage Δ
pester	85.22% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Dependency Review — fix(build): pin basic-ftp to 5.3.0

Note: This PR was not authored by dependabot[bot], so the automated Dependabot approval workflow does not apply. The general dependency review below covers the change.

---

Changes Identified

Package	Change	Type	License
basic-ftp (transitive)	5.2.2 → 5.3.0 via overrides	Minor bump (security fix)	MIT ✅

Review Dimensions

1. New Dependencies
No new dependencies are introduced. basic-ftp was already present in the dependency tree transitively via markdown-link-check → proxy-agent → pac-proxy-agent → get-uri → basic-ftp. The overrides entry pins the transitive version to a patched release without adding a new direct dependency.

2. Version Update — basic-ftp 5.2.2 → 5.3.0

• Minor version bump. No breaking changes are expected.
• Resolves GHSA-rp42-5vxx-qpwr: unbounded memory consumption in Client.list() (denial of service vector).
• License remains MIT — compatible with the project's MIT license.
• The overrides approach matches the existing repo pattern (markdown-it, picomatch, undici, yaml, yauzl, etc. are all pinned the same way).

3. SHA Pinning Compliance
No GitHub Actions workflow files were modified. Not applicable.

4. Devcontainer and Setup Alignment
No .devcontainer/ or copilot-setup-steps.yml changes. Not applicable.

---

Summary

All dependency review checks pass. The change is a targeted, minimal security fix using the established repo convention for transitive overrides. Human review is recommended before merging, given this is not a Dependabot-automated bump.

Generated by Dependabot PR Review for issue #1374 · ● 409.9K

[github-actions]

Advisory review, this PR is from a maintainer. Findings are informational only.

---

Review Summary

This is a minimal, focused security patch that pins basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr. The implementation is clean, follows the existing overrides convention in the repository, and the dependency review bot has already confirmed zero vulnerabilities in the introduced version. The change is low-risk and well-justified.

---

Issue Alignment

⚠️ No linked issue. The PR declares "Related Issue(s): None." For security advisory patches, creating a tracking issue (even a brief one referencing the GHSA ID) is recommended so the fix is discoverable in the issue tracker. This is advisory — not a blocker.

---

PR Template Compliance

⚠️ Required Automated Checks checkboxes are unchecked. The PR description documents that npm install --package-lock-only, npm audit, and npm run lint:dependency-pinning all passed, which is excellent. However, the required automated checks checklist items in the template body remain unchecked:

• npm run lint:md
• npm run spell-check
• npm run frontmatter validation
• etc.

For a dependency-only change, most of these are N/A, but checking them off (or annotating with N/A) provides clearer signal to reviewers and keeps the template consistent. Advisory — not a blocker.

---

Coding Standards

✅ No applicable instruction files govern package.json or package-lock.json changes. The override entry follows the existing pattern in the file (no version specifier needed for a single-instance transitive dep, consistent with markdown-it, smol-toml, undici, and yauzl).

---

Code Quality

✅ The diff is minimal and correct:

• package.json: one line added to the overrides block, alphabetically out of order (placed before markdown-it) but consistent in style.
• package-lock.json: version, resolved URL, and integrity hash updated for the single node_modules/basic-ftp entry.

No logic errors, no security regressions, no resource leaks, no breaking changes.

---

Action Items (Advisory)

1. Consider opening a tracking issue referencing GHSA-rp42-5vxx-qpwr so the fix is searchable in the issue history.
2. Check off (or mark N/A) the Required Automated Checks checkboxes in the PR description for template completeness.

Generated by PR Review for issue #1374 · ● 561.8K