fix: upgrade basic-ftp to 5.2.0 (CVE-2026-27699)

[orbisai0security]

Summary

Upgrade basic-ftp from 5.0.5 to 5.2.0 to fix CVE-2026-27699.

Vulnerability

Field	Value
ID	CVE-2026-27699
Severity	CRITICAL
Scanner	trivy
Rule	CVE-2026-27699
File	pnpm-lock.yaml

Description: basic-ftp: basic-ftp: File overwrite due to path traversal

Changes

• package.json
• pnpm-lock.yaml

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[gemini-code-assist]

Code Review

This pull request adds the basic-ftp dependency to the root package.json. Feedback indicates that for this pnpm monorepo, version overrides for transitive dependencies should be placed in the pnpm.overrides section rather than the root dependencies to maintain project standards.

[gemini-code-assist]

While this change would resolve the vulnerability, adding dependencies directly to the root package.json is not a standard practice in this pnpm monorepo. For transitive dependencies like basic-ftp, the idiomatic way to enforce a version is by using pnpm.overrides. This keeps the root package.json clean and clearly states the intention of overriding a dependency version across the workspace. Additionally, please verify the maintenance and security status of basic-ftp@5.2.0 to ensure the vulnerability data is not outdated; for instance, a library reported as deprecated might have resumed maintenance. Please revert this change and instead add "basic-ftp": "5.2.0" to the pnpm.overrides section.

    }
}

References

1. Verify the maintenance and security status of dependencies flagged by automated tools, as this information may be outdated. A library reported as deprecated might have resumed maintenance.