Repository navigation
Releases
Releases · patrickjuchli/basic-ftp
6.2.6
Immutable
release. Only release title and notes can be modified.
- Fixed: Path traversal in
downloadToDir(), fixes GHSA-2w5v-vj22-jp27.
6.2.5
Immutable
release. Only release title and notes can be modified.
- Changed: Releases are now built on GitHub Actions and published with npm provenance. Read RELEASING.md for the complete process.
6.2.4
Immutable
release. Only release title and notes can be modified.
- Fixed: A fact named
__proto__in an MLSD directory listing made listing a directory fail with a TypeError, fixes GHSA-5pm8-86m8-9m6r.
6.2.3
Immutable
release. Only release title and notes can be modified.
- Fixed: A password or a path of a resumed download containing control characters could throw an uncaught exception and terminate the process, fixes GHSA-r4jh-29pc-gfqr.
- Fixed: A command rejected for containing control characters left the client unusable.
- Fixed: The error for a rejected
PASScommand included the password.
6.2.2
Immutable
release. Only release title and notes can be modified.
- Fixed: Protect against excessive CPU use when detecting an MLSD directory listing or parsing a PASV response, fixes GHSA-5rfr-xx34-2xxv.
6.2.1
Immutable
release. Only release title and notes can be modified.
- Fixed: Protect against excessive CPU use when parsing a directory listing, fixes GHSA-c475-qrg2-pj4r.
- Fixed: A transfer could time out right after a slow local source or destination stopped holding it up, before the server had a chance to continue.
6.2.0
Immutable
release. Only release title and notes can be modified.
- Changed: Timeout tracking during data transfers now only applies to the server, not a slow local source or destination.
- Fixed: A failed transfer could report its failure twice and cancel an unrelated command issued afterwards, leaving it without a response.
6.1.0
Immutable
release. Only release title and notes can be modified.
- Changed: Uploading from a local path now throws if the file changes while it's being read, instead of reporting the incomplete upload as successful.
6.0.2
Immutable
release. Only release title and notes can be modified.
- Fixed: Implicit FTPS transfers against servers requiring TLS session reuse failed with "425 ... TLS session of data connection not resumed" on Node.js with the CVE-2026-48934 fix (22.23.0+, 24.17.0+, 26.3.1+).
6.0.1
Immutable
release. Only release title and notes can be modified.
- Fixed: Use and renew TLS 1.3 session tickets for data connections. (Thanks for testing, @dennisameling)
Contributors
dennisameling
