fix(deps): pin basic-ftp to 5.3.1 to fully clear CVE-2026-39983 and 3 sibling HIGH advisories

[time-attack]

basic-ftp reaches the dependency tree only transitively:

puppeteer-core → @puppeteer/browsers → proxy-agent → pac-proxy-agent → get-uri → basic-ftp

Versions ≤ 5.3.0 carry four HIGH advisories, all fixed in 5.3.1:

• GHSA-chqc-8p9q-pq6q (CVE-2026-39983) — FTP command injection via CRLF
• GHSA-6v7q-wjvx-w8wg — incomplete CRLF protection (USER/PASS + MKD bypass)
• GHSA-rpmf-866q-6p89 — DoS via unbounded multiline control-response buffering
• GHSA-rp42-5vxx-qpwr — DoS via unbounded memory in Client.list()

Fix

Pin via a bun overrides entry so every basic-ftp in the tree resolves to 5.3.1 (including get-uri's nested copy), rather than adding a phantom direct dependency. bun audit goes from 4 basic-ftp HIGH advisories to 0 (repo total 37 → 33, HIGH 13 → 9). 5.3.1 stays within get-uri's ^5.0.2 range and avoids the 6.x major bump.

Adds test/basic-ftp-security-pin.test.ts — a deterministic, offline tripwire that fails if any resolved basic-ftp in bun.lock (including nested paths like get-uri/basic-ftp) is below 5.3.1.

Why this supersedes #2205

#2205 bumps basic-ftp to 5.2.1 as a direct dependency. Verified locally: after that change, bun keeps get-uri/basic-ftp@5.2.0 nested, the root 5.2.1 copy is unused (gstack imports nothing from basic-ftp), and bun audit still reports all four HIGH advisories unchanged. 5.2.1 would also only address 1 of the 4 (the incomplete-CRLF follow-up needs 5.2.2; the two DoS advisories need 5.3.1).

Verification

• Clean bun install → only basic-ftp@5.3.1 in the tree; bun audit reports zero basic-ftp advisories.
• Live FTP server (ftp-srv) round-trip on 5.3.1: list / downloadTo / uploadFrom / cd / pwd / size all work identically to 5.2.0 on legitimate paths.
• Security behavior confirmed: a CRLF path (cd("nowhere\r\nDELE SENTINEL.txt")) that deletes a file on 5.2.0 is rejected client-side on 5.3.1 ("Contains control characters").
• get-uri@6.0.5 fetches an ftp:// URI on the overridden 5.3.1 — the exact operation pac-proxy-agent performs.
• Free test suite: no new failures.

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here