chore(security): override basic-ftp to ^6.2.1 instead of suppressing GHSA-c475-qrg2-pj4r

get-uri caps basic-ftp at ^5.3.1, but an override clears the advisory the same way the existing ip-address override does. The Client API get-uri uses is unchanged in 6.x.

Co-authored-by: Isaac <no-reply@databricks.com>
Signed-off-by: Vu Anh Phung <vu.phung@databricks.com>

Author: vuanhphung

SECURITY-OVERRIDES.md

@@ -13,12 +13,13 @@ This file documents the provenance and exit condition for each override. **When
 
 ## Entries
 
-### `basic-ftp: ^5.3.1`
+### `basic-ftp: ^6.2.1`
 
 - **Class**: runtime
 - **Path**: `proxy-agent → pac-proxy-agent → get-uri → basic-ftp`
-- **CVEs cleared**: GHSA-5rq4-664w-9x2c, GHSA-6v7q-wjvx-w8wg, GHSA-rp42-5vxx-qpwr, GHSA-rpmf-866q-6p89
-- **Exit**: `get-uri` bumps its `basic-ftp` dep range to include `^5.3.1`.
+- **CVEs cleared**: GHSA-5rq4-664w-9x2c, GHSA-6v7q-wjvx-w8wg, GHSA-rp42-5vxx-qpwr, GHSA-rpmf-866q-6p89, GHSA-c475-qrg2-pj4r
+- **Why an override is needed**: `get-uri` (through 8.0.1) caps `basic-ftp` at `^5.3.1`, below the 6.2.1 fix. The `Client` API get-uri uses is unchanged in 6.x; the 6.0 major only defaults `allowSeparateTransferHost` to `false`, so a PASV reply naming a different host is rejected.
+- **Exit**: `get-uri` widens its `basic-ftp` range to include `^6.2.1`.
 
 ### `@75lb/deep-merge: ^1.1.2`
 

osv-scanner.toml

@@ -35,8 +35,3 @@
 id = "GHSA-vfj7-8cjw-p6xm"
 ignoreUntil = 2027-04-05
 reason = "braces: no fixed release (3.0.3 is latest). Dev-only (mocha -> chokidar, globby -> fast-glob -> micromatch); not in shipped dist/."
-
-[[IgnoredVulns]]
-id = "GHSA-c475-qrg2-pj4r"
-ignoreUntil = 2027-04-05
-reason = "basic-ftp: fix is 6.2.1 but get-uri (latest 8.0.1) pins ^5.3.1. Vulnerable Client.list() is only reached via pac+ftp:// proxy URLs; ProxyOptions.protocol allows only http/https/socks*."

package-lock.json

@@ -101,7 +101,7 @@
     "@databricks/databricks-sql-kernel-win32-arm64-msvc": "1.1.0"
   },
   "overrides": {
-    "basic-ftp": "^5.3.1",
+    "basic-ftp": "^6.2.1",
     "@75lb/deep-merge": "^1.1.2",
     "ws": "^8.18.0",
     "ip-address": "^10.1.1",