basic-ftp
6.2.3 · 9 Oct 2026MIT27.3M / weekRepositoryHomepagenpmAtom feed
Upgrading basic-ftp from 1.0.2 to 1.2.0
10 releases in betweenevery note read
Security
5 advisories still affect 1.2.0
- Basic FTP has Path Traversal Vulnerability in its downloadToDir() methodcritical · GHSA-5rq4-664w-9x2c
- basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commandshigh · GHSA-6v7q-wjvx-w8wg
- basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)high · GHSA-c475-qrg2-pj4r
Upgrading to 6.2.1 clears them.
Release by release
- new
Add functions to upload, download and remove whole directories.
- new
Add function to ensure a given remote path, creating all directories as necessary.
- new
1.1.1nothing new or fixed in the note
- new
Add convenience functions to request and change the current working directory.
- new
1.0.9nothing new or fixed in the note
- fixed
Fix result for send command.
- fixed
1.0.3 – 1.0.75 releases, nothing new or fixed in the notes
9 other lines we could not sort, mostly version bumps
- 1.1.1
Differentiate between Basic API and Convenience API in documentation.
- 1.1.0
Return positive response results whenever reasonable.
- 1.0.9
Listeners using
oncewherever possible. - 1.0.7
Improve documentation.
- 1.0.6
Close sockets on timeout.
- 1.0.5
Close data socket explicitly after upload is done.
- 1.0.4
List: Some servers send confirmation on control socket before the data arrived.
- 1.0.3
List: Wait until server explicitly confirms that the transfer is complete.
- 1.0.3
Upload: Close data socket manually when a stream ended.