Skip to content

chore(deps): Bump basic-ftp to 6.2.2 - #6837

Merged
alwx merged 1 commit into
mainfrom
alwx/bugfix/basic-ftp-dos
Oct 5, 2026
Merged

alwx merged 1 commit into
mainfrom
alwx/bugfix/basic-ftp-dos

Conversation

@alwx

@alwx alwx commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

📢 Type of change

  • Bugfix

📜 Description

This change sets the basic-ftp resolution to ^6.2.2. The lockfile now uses basic-ftp@6.2.2 instead of 5.3.1.

💡 Motivation and Context

Version 5.3.1 has a CPU denial-of-service vulnerability in the directory listing parser (GHSA-c475-qrg2-pj4r). The 5.x line has no fix. Version 6.2.2 also fixes GHSA-5rfr-xx34-2xxv. The package is a dev dependency through proxy-agent and get-uri, and the SDK does not ship it.

Fixes Dependabot alert #684.

💚 How did you test it?

yarn install and yarn lint pass.

📝 Checklist

  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • No breaking changes.

🤖 Generated with Claude Code

The new version fixes GHSA-c475-qrg2-pj4r and GHSA-5rfr-xx34-2xxv.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


  • chore(deps): Bump basic-ftp to 6.2.2 by alwx in #6837
  • fix(core): Mark package as side-effect free by devclaimjuimperai in #6829
  • chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.31.0 to 2.33.1 by dependabot in #6833
  • chore(deps): bump gradle/actions/setup-gradle from 6.3.0 to 6.4.0 by dependabot in #6834
  • chore(deps): bump getsentry/craft from 2.31.2 to 2.33.1 by dependabot in #6835
  • chore(deps): bump getsentry/github-workflows/validate-pr from 4013fc6e1aeb1be1f9d3b4d232624f0ec1afa613 to 36c729264d2edc29ebae61950c50e1e9f043ad7e by dependabot in #6832
  • fix(android): Settle initNativeReactNavigationNewFrameTracking promise by antonis in #6823
  • fix(spotlight): Forward image attachments to Spotlight by antonis in #6818
  • fix(ios): Prevent crash when initialized with an invalid DSN by antonis in #6825
  • chore(core): Resolve non-actionable TODOs by antonis in #6826
  • chore(core): resolve stale TODO comments by antonis in #6819
  • fix(profiling): Populate Hermes runtime version on JS profiles by antonis in #6817

🤖 This preview updates automatically when you update the PR.

@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor
Fails
🚫 Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against f1d2ca4

@alwx
alwx marked this pull request as ready for review October 5, 2026 08:58
@alwx
alwx merged commit d66789e into main Oct 5, 2026
67 of 73 checks passed
@alwx
alwx deleted the alwx/bugfix/basic-ftp-dos branch October 5, 2026 09:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants