Skip to content

chore: remove basic-ftp override — lockfile resolution is sufficient#7380

Closed
Copilot wants to merge 4 commits intodevelopfrom
copilot/remove-basic-ftp-dependency
Closed

chore: remove basic-ftp override — lockfile resolution is sufficient#7380
Copilot wants to merge 4 commits intodevelopfrom
copilot/remove-basic-ftp-dependency

Conversation

Copy link
Copy Markdown

Copilot AI commented Mar 19, 2026

The pnpm.overrides exception for basic-ftp is unnecessary. get-uri already declares basic-ftp@^5.0.2, which naturally satisfies 5.2.0. The lockfile was simply frozen to 5.0.5 from a previous install; updating the pinned version directly is the correct fix.

Changes

  • package.json: Remove the pnpm.overrides block for basic-ftp
  • pnpm-lock.yaml: Remove the overrides section; basic-ftp resolves to 5.2.0 via the existing ^5.0.2 range in get-uri

Dependency chain for reference:

live-plugin-manager → proxy-agent → pac-proxy-agent → get-uri → basic-ftp@^5.0.2 → resolves to 5.2.0

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

…ransitive dependency

Co-authored-by: JohnMcLear <220864+JohnMcLear@users.noreply.github.com>
Copilot AI changed the title [WIP] Remove unused basic-ftp dependency chore: override basic-ftp to non-deprecated safe version Mar 19, 2026
Copilot AI requested a review from JohnMcLear March 19, 2026 11:22
…ly basic-ftp 5.0.5→5.2.0 change

Co-authored-by: JohnMcLear <220864+JohnMcLear@users.noreply.github.com>
Copilot AI changed the title chore: override basic-ftp to non-deprecated safe version chore: remove vulnerable basic-ftp transitive dependency Mar 19, 2026
@JohnMcLear
Copy link
Copy Markdown
Member

JohnMcLear commented Mar 19, 2026

@copilot The problem with this pull request is that it creates an exception for this package. I don't like it, shouldn't the upstream fix be implemented IE in live-plugin-manager → proxy-agent → pac-proxy-agent → get-uri or have we fixed the verison of one of those which is why it's not landed?

…ge already allows 5.2.0

Co-authored-by: JohnMcLear <220864+JohnMcLear@users.noreply.github.com>
Copilot AI changed the title chore: remove vulnerable basic-ftp transitive dependency chore: remove basic-ftp override — lockfile resolution is sufficient Mar 19, 2026
@SamTV12345
Copy link
Copy Markdown
Member

@copilot The problem with this pull request is that it creates an exception for this package. I don't like it, shouldn't the upstream fix be implemented IE in live-plugin-manager → proxy-agent → pac-proxy-agent → get-uri or have we fixed the verison of one of those which is why it's not landed?

Is AI now contributing itself to our project. That's funny :) I don't really get what Copilot is trying to do.

Copy link
Copy Markdown
Author

Copilot AI commented Mar 19, 2026

@copilot The problem with this pull request is that it creates an exception for this package. I don't like it, shouldn't the upstream fix be implemented IE in live-plugin-manager → proxy-agent → ...

The override has been removed in d6be191. get-uri already declares basic-ftp@^5.0.2, which naturally satisfies 5.2.0 — no upstream package needed changing. The lockfile was simply frozen to 5.0.5 from an older install. The fix was to drop the pnpm.overrides block entirely and let the existing semver range resolve to 5.2.0 on its own.

Copilot AI requested a review from SamTV12345 March 19, 2026 22:03
@SamTV12345
Copy link
Copy Markdown
Member

@copilot The problem with this pull request is that it creates an exception for this package. I don't like it, shouldn't the upstream fix be implemented IE in live-plugin-manager → proxy-agent → ...

The override has been removed in d6be191. get-uri already declares basic-ftp@^5.0.2, which naturally satisfies 5.2.0 — no upstream package needed changing. The lockfile was simply frozen to 5.0.5 from an older install. The fix was to drop the pnpm.overrides block entirely and let the existing semver range resolve to 5.2.0 on its own.

That makes sense. Thanks!

Copy link
Copy Markdown
Author

Copilot AI commented Mar 19, 2026

@SamTV12345 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 71439a89-dc3c-4007-9b23-b4459a49a5a3

5 similar comments
Copy link
Copy Markdown
Author

Copilot AI commented Mar 19, 2026

@SamTV12345 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 71439a89-dc3c-4007-9b23-b4459a49a5a3

Copy link
Copy Markdown
Author

Copilot AI commented Mar 19, 2026

@SamTV12345 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 71439a89-dc3c-4007-9b23-b4459a49a5a3

Copy link
Copy Markdown
Author

Copilot AI commented Mar 19, 2026

@SamTV12345 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 71439a89-dc3c-4007-9b23-b4459a49a5a3

Copy link
Copy Markdown
Author

Copilot AI commented Mar 19, 2026

@SamTV12345 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 71439a89-dc3c-4007-9b23-b4459a49a5a3

Copy link
Copy Markdown
Author

Copilot AI commented Mar 19, 2026

@SamTV12345 The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 71439a89-dc3c-4007-9b23-b4459a49a5a3

Copy link
Copy Markdown
Member

@SamTV12345 SamTV12345 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@JohnMcLear JohnMcLear closed this Mar 20, 2026
@JohnMcLear
Copy link
Copy Markdown
Member

I didn't like it, it's unnecessary surgery that will be patched upstream and exposed 0 attack vectors to the software. Was unnecessary noise I should have probably just ignored :P

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants