diff --git a/SECURITY-OVERRIDES.md b/SECURITY-OVERRIDES.md index 15870cd1..0334d1d2 100644 --- a/SECURITY-OVERRIDES.md +++ b/SECURITY-OVERRIDES.md @@ -13,12 +13,13 @@ This file documents the provenance and exit condition for each override. **When ## Entries -### `basic-ftp: ^5.3.1` +### `basic-ftp: ^6.2.1` - **Class**: runtime - **Path**: `proxy-agent → pac-proxy-agent → get-uri → basic-ftp` -- **CVEs cleared**: GHSA-5rq4-664w-9x2c, GHSA-6v7q-wjvx-w8wg, GHSA-rp42-5vxx-qpwr, GHSA-rpmf-866q-6p89 -- **Exit**: `get-uri` bumps its `basic-ftp` dep range to include `^5.3.1`. +- **CVEs cleared**: GHSA-5rq4-664w-9x2c, GHSA-6v7q-wjvx-w8wg, GHSA-rp42-5vxx-qpwr, GHSA-rpmf-866q-6p89, GHSA-c475-qrg2-pj4r +- **Why an override is needed**: `get-uri` (through 8.0.1) caps `basic-ftp` at `^5.3.1`, below the 6.2.1 fix. The `Client` API get-uri uses is unchanged in 6.x; the 6.0 major only defaults `allowSeparateTransferHost` to `false`, so a PASV reply naming a different host is rejected. +- **Exit**: `get-uri` widens its `basic-ftp` range to include `^6.2.1`. ### `@75lb/deep-merge: ^1.1.2` diff --git a/osv-scanner.toml b/osv-scanner.toml index b15bf0d4..a4abc06d 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -16,7 +16,7 @@ # # CONVENTION: use suppressions sparingly, only with a strong reason # (unreachable code path + no fix available, or dev-only + not shipped). -# EVERY [[IgnoredVulns]] entry MUST set `ignoreUntil = "YYYY-MM-DD"` +# EVERY [[IgnoredVulns]] entry MUST set `ignoreUntil = YYYY-MM-DD` # (~6 months out). OSV-Scanner v2.3.8 honors it natively; when it lapses # the finding re-surfaces, forcing a re-review instead of a permanent # silent ignore. @@ -24,9 +24,14 @@ # Example: # [[IgnoredVulns]] # id = "GHSA-xxxx-xxxx-xxxx" -# ignoreUntil = "2026-01-15" +# ignoreUntil = 2026-01-15 # bare TOML date; a quoted string fails to parse # reason = "dev-only (eslint toolchain); not reachable from shipped dist/." # # This file starts empty -- populate iteratively as the first scan run # surfaces real false positives or dev-only findings worth excluding. # Do not pre-populate with speculative suppressions. + +[[IgnoredVulns]] +id = "GHSA-vfj7-8cjw-p6xm" +ignoreUntil = 2027-04-05 +reason = "braces: no fixed release (3.0.3 is latest). Dev-only (mocha -> chokidar, globby -> fast-glob -> micromatch); not in shipped dist/." diff --git a/package-lock.json b/package-lock.json index 5d7804ab..0922a372 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1842,9 +1842,9 @@ } }, "node_modules/basic-ftp": { - "version": "5.3.1", - "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz", - "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==", + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.1.tgz", + "integrity": "sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k15NWxyEjmaKtZPlgce58So4BNTjITGQOVTjL9y0ECA==", "license": "MIT", "engines": { "node": ">=10.0.0" @@ -1860,9 +1860,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -3993,9 +3993,9 @@ } }, "node_modules/ip-address": { - "version": "10.3.1", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.3.1.tgz", - "integrity": "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==", + "version": "10.7.2", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz", + "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==", "license": "MIT", "engines": { "node": ">= 12" @@ -4786,9 +4786,9 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -8098,9 +8098,9 @@ "dev": true }, "basic-ftp": { - "version": "5.3.1", - "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz", - "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==" + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.1.tgz", + "integrity": "sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k15NWxyEjmaKtZPlgce58So4BNTjITGQOVTjL9y0ECA==" }, "binary-extensions": { "version": "2.2.0", @@ -8109,9 +8109,9 @@ "dev": true }, "brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "requires": { "balanced-match": "^1.0.0", @@ -9386,7 +9386,7 @@ "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-6.0.2.tgz", "integrity": "sha512-5KLucCJobh8vBY1K07EFV4+cPZH3mrV9YeAruUseCQKHB58SGjjT2l9/eA9LD082IiuMjSlFJEcdJ27TXvbZNw==", "requires": { - "basic-ftp": "^5.3.1", + "basic-ftp": "^6.2.1", "data-uri-to-buffer": "^6.0.0", "debug": "^4.3.4", "fs-extra": "^8.1.0" @@ -9633,9 +9633,9 @@ } }, "ip-address": { - "version": "10.3.1", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.3.1.tgz", - "integrity": "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==" + "version": "10.7.2", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz", + "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==" }, "is-arrayish": { "version": "0.3.2", @@ -10204,9 +10204,9 @@ }, "dependencies": { "brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "requires": { "balanced-match": "^1.0.0" diff --git a/package.json b/package.json index 438b0220..db2b07a2 100644 --- a/package.json +++ b/package.json @@ -101,7 +101,7 @@ "@databricks/databricks-sql-kernel-win32-arm64-msvc": "1.1.0" }, "overrides": { - "basic-ftp": "^5.3.1", + "basic-ftp": "^6.2.1", "@75lb/deep-merge": "^1.1.2", "ws": "^8.18.0", "ip-address": "^10.1.1",