security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-6v7q-wjvx-w8wg	basic-ftp, puppeteer-core	None	24.37.5	5.3.1		confirmed

Not Included

• Deferred by batch limit: 5 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	google.golang.org/grpc	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	puppeteer-core	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Lockfile-only dependency bump in a private e2e test package with no runtime or auth logic changes.

Overview
Addresses GHSA-6v7q-wjvx-w8wg in the server/e2e/bidi test package by adding a direct dependency on basic-ftp ^5.3.1 and refreshing the lockfile so the resolved copy moves from 5.2.0 to 5.3.1.

That override ensures the vulnerable transitive basic-ftp pulled in through the Puppeteer-related stack (e.g. via get-uri) is replaced with the patched release. No application or test source files are modified—only package.json and package-lock.json.

^{Reviewed by Cursor Bugbot for commit 2096490. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​basic-ftp@​5.2.0 ⏵ 5.3.1	+1	+40	+1	+36

View full report