upgarde transitive deps/ Synk reported potential vulnerability for basic-ftp transitive dependency (#497)

* deps override, since upgrading proxy agent to v7 wont fix the potential vulnerability, v8 is esm only which requires some woraround for module compatibility.

* update coderabbit configuration as per new schema validation rules at v2

* package-lock to have safe version of basic-ftp at get-uri

* PubNub SDK v11.0.1 release.

---------

Co-authored-by: Mohit Tejani <mohit.tejani@Mohits-MacBook-Pro.local>
Co-authored-by: PubNub Release Bot <120067856+pubnub-release-bot@users.noreply.github.com>

Author: 3 people

.coderabbit.yaml

@@ -17,6 +17,17 @@ reviews:
     enabled: true
     drafts: true
 
+  # Sparse-checkout / review scope: include .github explicitly; exclude generated and vendor paths
+  path_filters:
+    - ".github/**"
+    - "!dist/**"
+    - "!lib/**"
+    - "!upload/**"
+    - "!node_modules/**"
+    - "!package-lock.json"
+    - "!.pubnub.yml"
+    - "!.vscode/**"
+
   # Path-based review instructions
   path_instructions:
     - path: "src/core/**"
@@ -69,37 +80,27 @@ reviews:
         - Proper use of mocks/stubs (Sinon + Nock)
         - No flaky patterns (hardcoded timeouts, race conditions)
         - Tests that actually assert meaningful behavior
+    - path: ".github/**"
+      instructions: |
+        GitHub Actions workflows and repo automation. Review for:
+        - Valid workflow YAML (triggers, concurrency, job dependencies)
+        - Safe use of secrets and minimal required permissions
+        - Reasonable timeouts and matrix coverage; actionlint/YAMLlint findings should be addressed
 
   # Tools configuration
   tools:
     # Enable GitHub checks integration
     github-checks:
       enabled: true
       timeout_ms: 120000
+    yamllint:
+      enabled: true
+    actionlint:
+      enabled: true
 
 chat:
   auto_reply: true
 
 knowledge_base:
   mcp:
     usage: enabled
-
-# Path filters - ignore generated/vendored/build output
-path_filters:
-  # Build outputs
-  - "!dist/**"
-  - "!lib/**"
-  - "!upload/**"
-
-  # Dependencies
-  - "!node_modules/**"
-
-  # Lock files - too noisy, low review value
-  - "!package-lock.json"
-
-  # Config/metadata that rarely needs review
-  - "!.pubnub.yml"
-  - "!.vscode/**"
-
-  # Generated type bundles
-  - "!lib/types/**"

.pubnub.yml

@@ -1,5 +1,10 @@
 ---
 changelog:
+  - date: 2026-05-13
+    version: v11.0.1
+    changes:
+      - type: improvement
+        text: "Bumped version of basic-ftp through override deps for proxy agent to use safe transitive dependency."
   - date: 2026-04-20
     version: v11.0.0
     changes:
@@ -1406,7 +1411,7 @@ supported-platforms:
       - 'Ubuntu 14.04 and up'
       - 'Windows 7 and up'
     version: 'Pubnub Javascript for Node'
-version: '11.0.0'
+version: '11.0.1'
 sdks:
   - full-name: PubNub Javascript SDK
     short-name: Javascript
@@ -1422,7 +1427,7 @@ sdks:
           - distribution-type: source
             distribution-repository: GitHub release
             package-name: pubnub.js
-            location: https://github.com/pubnub/javascript/archive/refs/tags/v11.0.0.zip
+            location: https://github.com/pubnub/javascript/archive/refs/tags/v11.0.1.zip
             requires:
               - name: 'agentkeepalive'
                 min-version: '3.5.2'
@@ -2093,7 +2098,7 @@ sdks:
           - distribution-type: library
             distribution-repository: GitHub release
             package-name: pubnub.js
-            location: https://github.com/pubnub/javascript/releases/download/v11.0.0/pubnub.11.0.0.js
+            location: https://github.com/pubnub/javascript/releases/download/v11.0.1/pubnub.11.0.1.js
             requires:
               - name: 'agentkeepalive'
                 min-version: '3.5.2'

CHANGELOG.md

@@ -1,3 +1,9 @@
+## v11.0.1
+May 13 2026
+
+#### Modified
+- Bumped version of basic-ftp through override deps for proxy agent to use safe transitive dependency.
+
 ## v11.0.0
 April 20 2026
 

README.md

@@ -27,8 +27,8 @@ Watch [Getting Started with PubNub JS SDK](https://app.dashcam.io/replay/64ee0d2
      npm install pubnub
      ```
    * or download one of our builds from our CDN: 
-     * https://cdn.pubnub.com/sdk/javascript/pubnub.11.0.0.js
-     * https://cdn.pubnub.com/sdk/javascript/pubnub.11.0.0.min.js
+     * https://cdn.pubnub.com/sdk/javascript/pubnub.11.0.1.js
+     * https://cdn.pubnub.com/sdk/javascript/pubnub.11.0.1.min.js
 
 2. Configure your keys:
 

dist/web/pubnub.js

@@ -5432,7 +5432,7 @@
 	            return base.PubNubFile;
 	        },
 	        get version() {
-	            return '11.0.0';
+	            return '11.0.1';
 	        },
 	        getVersion() {
 	            return this.version;

dist/web/pubnub.min.js

@@ -168,7 +168,7 @@ const makeConfiguration = (base, setupCryptoModule) => {
             return base.PubNubFile;
         },
         get version() {
-            return '11.0.0';
+            return '11.0.1';
         },
         getVersion() {
             return this.version;

lib/core/components/configuration.js

@@ -1,6 +1,6 @@
 {
   "name": "pubnub",
-  "version": "11.0.0",
+  "version": "11.0.1",
   "author": "PubNub <support@pubnub.com>",
   "description": "Publish & Subscribe Real-time Messaging with PubNub",
   "scripts": {
@@ -68,6 +68,9 @@
     "proxy-agent": "^6.3.0",
     "react-native-url-polyfill": "^2.0.0"
   },
+  "overrides": {
+    "basic-ftp": "5.3.1"
+  },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^25.0.7",
     "@rollup/plugin-json": "^6.1.0",

package-lock.json

@@ -236,7 +236,7 @@ export const makeConfiguration = (
       return base.PubNubFile;
     },
     get version(): string {
-      return '11.0.0';
+      return '11.0.1';
     },
     getVersion(): string {
       return this.version;