From 3931fadd472ad81e6e877c20e6f03b5725c81c79 Mon Sep 17 00:00:00 2001
From: Harsh Bhanushali <bhanushaliharsh434@gmail.com>
Date: Wed, 28 Oct 2026 15:51:53 +0000
Subject: [PATCH] Override basic-ftp to ^6.2.1 to fix GHSA-c475-qrg2-pj4r

get-uri still depends on basic-ftp ^5.x, which has no patched release.
---
 package-lock.json | 6 +++---
 package.json      | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 559d2183e206..8c0d628b2b5e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1726,9 +1726,9 @@
       "license": "MIT"
     },
     "node_modules/basic-ftp": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz",
-      "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==",
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.3.tgz",
+      "integrity": "sha512-T7GYtQ2eKJUN5YORG7A8u2WfB9JMN0a4/wl3MI64qq2qTRfa3FXzoNq0DDojZDkDyStcL+TkfKsz4JHEZx5kGQ==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
diff --git a/package.json b/package.json
index ad493780f36e..034510966edb 100644
--- a/package.json
+++ b/package.json
@@ -90,6 +90,9 @@
   "resolutions": {
     "@types/node": "24.x"
   },
+  "overrides": {
+    "basic-ftp": "^6.2.1"
+  },
   "bin": {
     "code-server": "out/node/entry.js"
   },