[harshbhx]

Fixes #8078

basic-ftp <= 6.2.0 is affected by GHSA-c475-qrg2-pj4r (quadratic-time regex backtracking in the Unix listing parser used by Client.list()), fixed in 6.2.1. code-server only gets it transitively (proxy-agent -> pac-proxy-agent -> get-uri -> basic-ftp), and the newest get-uri (8.0.1) still depends on basic-ftp@^5.3.1, so a plain lockfile refresh can't reach a patched release.

This adds an overrides entry ("basic-ftp": "^6.2.1") and updates package-lock.json, which moves basic-ftp from 5.3.1 to 6.2.3. The lockfile diff is only the basic-ftp entry.

Compatibility: get-uri only uses new Client(), access, lastMod, list, downloadTo and close, all still present in 6.x. The one 6.0.0 breaking change is that separate transfer hosts are rejected by default (FTP bounce protection, https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.0.0). It only affects an FTP server whose PASV reply names a different host than the control connection. Here get-uri is only reached when a PAC script fetches an ftp: URL for a proxy config, so I expect the impact to be negligible.

Testing:

• Checked on my fork's CI (https://github.com/harshbhx/code-server/actions/runs/40720819144): npm ci accepts the lockfile, npm ls basic-ftp shows get-uri -> basic-ftp@6.2.3 overridden, and a local fake FTP server (USER/PASS/MDTM/PASV/RETR) served a file through get-uri's ftp: handler with the override applied.
• I did not run code-server's own build or test suite for this change, and it was not tested against a real FTP server. The repo's Build workflow does not run on my fork.

[code-asher]

Thank you! I see upstream has already bumped basic-ftp but looks like no new version yet, so overriding in the meantime makes sense to me.