From 5ca87456d1391678c8141d7236e5b935a68b9c08 Mon Sep 17 00:00:00 2001
From: t <t@t.co>
Date: Tue, 14 Jul 2026 12:57:05 -0700
Subject: [PATCH] fix(deps): pin basic-ftp to patched 5.3.1

---
 bun.lock                            |  5 ++++-
 package.json                        |  3 +++
 test/basic-ftp-security-pin.test.ts | 19 +++++++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 test/basic-ftp-security-pin.test.ts

diff --git a/bun.lock b/bun.lock
index 7a1833e943..90b8fddf46 100644
--- a/bun.lock
+++ b/bun.lock
@@ -22,6 +22,9 @@
       },
     },
   },
+  "overrides": {
+    "basic-ftp": "5.3.1",
+  },
   "packages": {
     "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.2.117", "", { "dependencies": { "@anthropic-ai/sdk": "^0.81.0", "@modelcontextprotocol/sdk": "^1.29.0" }, "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.2.117", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.2.117", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.2.117", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.2.117", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.2.117" }, "peerDependencies": { "zod": "^4.0.0" } }, "sha512-pVBss1Vu0w87nKCBhWtjMggSgCh6GVUtdRmuE58ZvXv0E2q0JcnUCQHehmn92BAW0+VCwPY8q/k7uKWkgwz/gA=="],
 
@@ -201,7 +204,7 @@
 
     "bare-url": ["bare-url@2.4.0", "", { "dependencies": { "bare-path": "^3.0.0" } }, "sha512-NSTU5WN+fy/L0DDenfE8SXQna4voXuW0FHM7wH8i3/q9khUSchfPbPezO4zSFMnDGIf9YE+mt/RWhZgNRKRIXA=="],
 
-    "basic-ftp": ["basic-ftp@5.2.0", "", {}, "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw=="],
+    "basic-ftp": ["basic-ftp@5.3.1", "", {}, "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw=="],
 
     "body-parser": ["body-parser@2.2.2", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^1.0.5", "debug": "^4.4.3", "http-errors": "^2.0.0", "iconv-lite": "^0.7.0", "on-finished": "^2.4.1", "qs": "^6.14.1", "raw-body": "^3.0.1", "type-is": "^2.0.1" } }, "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA=="],
 
diff --git a/package.json b/package.json
index c5168d6486..846438a603 100644
--- a/package.json
+++ b/package.json
@@ -76,5 +76,8 @@
     "@anthropic-ai/sdk": "^0.78.0",
     "xterm": "5",
     "xterm-addon-fit": "^0.8.0"
+  },
+  "overrides": {
+    "basic-ftp": "5.3.1"
   }
 }
diff --git a/test/basic-ftp-security-pin.test.ts b/test/basic-ftp-security-pin.test.ts
new file mode 100644
index 0000000000..5ca2ed8d95
--- /dev/null
+++ b/test/basic-ftp-security-pin.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const root = join(import.meta.dir, "..");
+
+describe("basic-ftp security resolution", () => {
+  test("pins every transitive resolution to the patched release", () => {
+    const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+    expect(pkg.overrides?.["basic-ftp"]).toBe("5.3.1");
+
+    const lock = readFileSync(join(root, "bun.lock"), "utf8");
+    const versions = [...lock.matchAll(/basic-ftp@(\d+\.\d+\.\d+)/g)].map(
+      ([, version]) => version,
+    );
+    expect(versions.length).toBeGreaterThan(0);
+    expect(new Set(versions)).toEqual(new Set(["5.3.1"]));
+  });
+});