Bump basic-ftp to >=6.2.1 to fix CVE-2026-102990 (DoS in Client.list()) #8078

What is your suggestion?

Bump the basic-ftp dependency to 6.2.1 or later. Currently it resolves to 5.3.1 (see package-lock.json), pulled in transitively via pac-proxy-agent -> get-uri -> basic-ftp.

Why do you want this feature?

basic-ftp versions <= 6.2.0 are affected by GHSA-c475-qrg2-pj4r (CVE-2026-102990), a quadratic-time regex-backtracking DoS in the Unix directory-listing parser used by Client.list(). It is fixed in 6.2.1.

I checked the current main branch's package-lock.json and basic-ftp is still pinned at 5.3.1 via get-uri's dependency, which hasn't been bumped to the 6.x line yet. Since 5.x -> 6.x is a major version bump for basic-ftp, this likely needs get-uri/pac-proxy-agent to update first (to confirm API compatibility), or alternatively an overrides entry in code-server's package.json forcing a patched basic-ftp version after verifying it doesn't break get-uri's usage.

Are there any workarounds to get this functionality today?

None found upstream yet. I didn't find any existing issue or PR in this repo proposing a bump of basic-ftp past 5.3.1.

Are you interested in submitting a PR for this?

Not at this time - flagging this so maintainers can assess compatibility with get-uri's use of the basic-ftp API before bumping, since it's a major version change.