fix(deps): resolve all npm audit vulnerabilities

[paustint]

Summary

npm audit on main reported 8 vulnerabilities (1 critical, 7 high), all in transitive dev dependencies pulled in by release-it. After this change it reports 0.

Package	Before	After	Advisory
shell-quote	1.10.0	1.12.0	GHSA-pqg4-j6r4-53mv (critical, command injection in quote())
source-map-js	1.2.1	1.2.2	GHSA-68fv-2mgg-jv7q (event-loop DoS)
undici	7.29.0	7.29.1	ten advisories, mostly DoS plus a shared-cache cookie disclosure and a TLS validation bypass in BalancedPool
basic-ftp	5.3.1	6.2.3	GHSA-c475-qrg2-pj4r (quadratic-time listing parser)

The first three were resolved by npm audit fix. release-it moved 21.1.0 → 21.1.1 as part of that, which dragged along a handful of @inquirer/* patch bumps.

Why basic-ftp needs an overrides entry

basic-ftp reaches us through release-it > proxy-agent > pac-proxy-agent > get-uri. The latest get-uri (8.0.1) still pins basic-ftp@^5.3.1, and there is no 5.x release with the fix, so npm's only automatic option was npm audit fix --force, which downgrades release-it to 15.x. Instead package.json now carries:

"overrides": { "basic-ftp": "^6.2.3" }

I checked that this is safe:

• The only breaking change in basic-ftp 6.0.0 is that separate transfer hosts are now refused by default (FTP bounce-attack hardening) behind a new allowSeparateTransferHost option. get-uri only calls access, lastMod, list, downloadTo and close, all of which are unchanged.
• Pinning to 6.2.3 rather than 6.2.1 also picks up GHSA-5rfr-xx34-2xxv and GHSA-r4jh-29pc-gfqr, which npm audit has not flagged yet.
• Engine requirement is node >=10, well within the Node 24 CI uses.

This code path is only exercised if release-it has to fetch a PAC file over FTP through a proxy, which never happens in our CI.

No changelog entry

The published package has zero runtime dependencies, so nothing a consumer installs changes. The Changelog workflow does not require an entry for changes outside src/. Happy to add one under ### Changed if you would rather record it.

Supersedes the open dependabot PRs

The lockfile on this branch already contains a newer version than each of #5, #6, #11, #13, #14 and #15 target (and lodash is no longer in the tree at all), so those can be closed once this merges. Note that #14's target, shell-quote@1.10.0, is itself inside the newly vulnerable range.

Verification

• npm audit → 0 vulnerabilities
• npm run format:check, npm run lint, npm run typecheck → clean
• npm test → 117 passed
• npm run build → esm, cjs and declarations emitted

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	release-it@​21.1.0 ⏵ 21.1.1

View full report

[Copilot]

🟢 Approval recommended

The development-only updates and matching lockfile introduce no identified blocking issues.

0 open findings

What changed in this PR

Updates development dependencies to address reported npm audit vulnerabilities without changing the published library’s runtime code.

Changes:

• Adds a basic-ftp override to use the patched 6.2.3 release.
• Refreshes release-it and related dependencies, including security fixes for shell-quote, source-map-js, and undici.

File	Description
package.json	Adds the patched basic-ftp override.
package-lock.json	Locks updated development dependencies and integrity hashes.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.