From eb699d697b27338cc8be949287c906b73b75c400 Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Sat, 11 Jul 2026 08:27:34 +0530 Subject: [PATCH] fix: use bun overrides to pin basic-ftp to 5.3.1, clearing all 4 HIGH advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous fix added basic-ftp as a direct dependency at 5.2.1, but this only installed a root-level copy. The transitive copy (get-uri → basic-ftp) remained at 5.2.0 in bun.lock, so bun audit still reported all four HIGH advisories. A direct dependency cannot force a nested copy to upgrade — that requires bun overrides. Switch to the correct mechanism: replace the direct dep with an overrides pin to 5.3.1, which collapses the get-uri/basic-ftp@5.2.0 nested entry and forces the single resolved copy to 5.3.1. Version 5.3.1 clears all four advisories (CVE-2026-39983, GHSA-6v7q-wjvx-w8wg, GHSA-rpmf-866q-6p89, GHSA-rp42-5vxx-qpwr) where 5.2.1 only cleared one. Add a bun.lock tripwire in audit-compliance.test.ts that fails CI if any basic-ftp reference below 5.3.1 reappears in the lockfile. Co-Authored-By: Claude Sonnet 4.6 --- bun.lock | 8 ++++---- package.json | 4 +++- test/audit-compliance.test.ts | 16 ++++++++++++++++ 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/bun.lock b/bun.lock index cd0c37abf..90b8fddf4 100644 --- a/bun.lock +++ b/bun.lock @@ -7,7 +7,6 @@ "dependencies": { "@huggingface/transformers": "^4.1.0", "@ngrok/ngrok": "^1.7.0", - "basic-ftp": "5.2.1", "diff": "^7.0.0", "html-to-docx": "1.8.0", "marked": "^18.0.2", @@ -23,6 +22,9 @@ }, }, }, + "overrides": { + "basic-ftp": "5.3.1", + }, "packages": { "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.2.117", "", { "dependencies": { "@anthropic-ai/sdk": "^0.81.0", "@modelcontextprotocol/sdk": "^1.29.0" }, "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.2.117", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.2.117", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.2.117", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.2.117" }, "peerDependencies": { "zod": "^4.0.0" } }, "sha512-pVBss1Vu0w87nKCBhWtjMggSgCh6GVUtdRmuE58ZvXv0E2q0JcnUCQHehmn92BAW0+VCwPY8q/k7uKWkgwz/gA=="], @@ -202,7 +204,7 @@ "bare-url": ["bare-url@2.4.0", "", { "dependencies": { "bare-path": "^3.0.0" } }, "sha512-NSTU5WN+fy/L0DDenfE8SXQna4voXuW0FHM7wH8i3/q9khUSchfPbPezO4zSFMnDGIf9YE+mt/RWhZgNRKRIXA=="], - "basic-ftp": ["basic-ftp@5.2.1", "", {}, "sha512-0yaL8JdxTknKDILitVpfYfV2Ob6yb3udX/hK97M7I3jOeznBNxQPtVvTUtnhUkyHlxFWyr5Lvknmgzoc7jf+1Q=="], + "basic-ftp": ["basic-ftp@5.3.1", "", {}, "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw=="], "body-parser": ["body-parser@2.2.2", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^1.0.5", "debug": "^4.4.3", "http-errors": "^2.0.0", "iconv-lite": "^0.7.0", "on-finished": "^2.4.1", "qs": "^6.14.1", "raw-body": "^3.0.1", "type-is": "^2.0.1" } }, "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA=="], @@ -688,8 +690,6 @@ "express-rate-limit/ip-address": ["ip-address@10.1.0", "", {}, "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q=="], - "get-uri/basic-ftp": ["basic-ftp@5.2.0", "", {}, "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw=="], - "htmlparser2/readable-stream": ["readable-stream@3.6.2", "", { "dependencies": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA=="], "onnxruntime-web/onnxruntime-common": ["onnxruntime-common@1.24.0-dev.20251116-b39e144322", "", {}, "sha512-BOoomdHYmNRL5r4iQ4bMvsl2t0/hzVQ3OM3PHD0gxeXu1PmggqBv3puZicEUVOA3AtHHYmqZtjMj9FOfGrATTw=="], diff --git a/package.json b/package.json index 23cabe3be..bc733fdcf 100644 --- a/package.json +++ b/package.json @@ -48,10 +48,12 @@ "slop": "npx slop-scan scan . 2>/dev/null || echo 'slop-scan not available (install with: npm i -g slop-scan)'", "slop:diff": "bun run scripts/slop-diff.ts" }, + "overrides": { + "basic-ftp": "5.3.1" + }, "dependencies": { "@huggingface/transformers": "^4.1.0", "@ngrok/ngrok": "^1.7.0", - "basic-ftp": "5.2.1", "diff": "^7.0.0", "html-to-docx": "1.8.0", "marked": "^18.0.2", diff --git a/test/audit-compliance.test.ts b/test/audit-compliance.test.ts index 80ef6dced..b0b1a306b 100644 --- a/test/audit-compliance.test.ts +++ b/test/audit-compliance.test.ts @@ -115,6 +115,22 @@ describe('Audit compliance', () => { expect(cdp).toContain('--remote-allow-origins='); }); + // CVE-2026-39983 + siblings: bun overrides must pin all copies of basic-ftp to 5.3.1 + test('bun.lock contains no basic-ftp older than 5.3.1 (override tripwire)', () => { + const lock = readFileSync(join(ROOT, 'bun.lock'), 'utf-8'); + // Match every "basic-ftp@X.Y.Z" reference in the lockfile + const matches = [...lock.matchAll(/"basic-ftp@(\d+)\.(\d+)\.(\d+)"/g)]; + expect(matches.length).toBeGreaterThan(0); + for (const m of matches) { + const [major, minor, patch] = [Number(m[1]), Number(m[2]), Number(m[3])]; + const isAtLeast531 = + major > 5 || + (major === 5 && minor > 3) || + (major === 5 && minor === 3 && patch >= 1); + expect(isAtLeast531).toBe(true); + } + }); + // Fix 2+6: All generated SKILL.md files with telemetry are conditional test('all generated SKILL.md files with telemetry calls use conditional pattern', () => { const skills = getAllSkillMds();