fix(deps): replace proxy-agent to drop basic-ftp (CVE-2026-102990)

[revopushbot]

Why

proxy-agent always installs pac-proxy-agent → get-uri → basic-ftp. Even the latest get-uri still requires basic-ftp ^5, which is vulnerable to CVE-2026-102990 (<= 6.2.0). Every consumer of @revopush/code-push, such as react-native-code-push-next, inherits the alert and can't fix it from their side.

What

RequestManager only ever passes a single fixed proxy URL (getProxyForUrl: () => this._proxy), so it doesn't need proxy-agent's resolution logic. It now builds the specific agent directly, chosen the same way proxy-agent 6.5 did:

Proxy URL	Target	Agent
http:// / https://	http	HttpProxyAgent
http:// / https://	https	HttpsProxyAgent
socks://, socks4(a)://, socks5(h)://	any	SocksProxyAgent

These are the same major versions proxy-agent 6.5 already installed (http-proxy-agent@7, https-proxy-agent@7, socks-proxy-agent@8), so Node support (>=14) is unchanged.

Behaviour change: PAC proxy URLs (pac+http://… etc.) are no longer supported. They now reject with Unsupported protocol for proxy URL, the same message proxy-agent used for unknown protocols.

The version is bumped to 4.6.1.

Verification

• npm ls basic-ftp get-uri pac-proxy-agent proxy-agent returns empty.
• npm run build:release passes.
• npm test: 50 passing, 1 failing (Acquisition SDK › disables api calls on unsuccessful response). It fails the same way on master, so this change didn't cause it.
• Smoke test against a local proxy: an HTTP target was forwarded through the proxy (GET http://…), an HTTPS target was tunnelled (CONNECT registry.npmjs.org:443), and pac+http:// rejected with a CodePushError.

After merge

Publish 4.6.1, then bump @revopush/code-push to 4.6.1 in react-native-code-push-next and drop the basic-ftp override from revopush/react-native-code-push-next#64.

🤖 Generated with Claude Code

[revopushbot]

Bumped the version to 4.7.0 instead of 4.6.1 (b399256). Dropping PAC proxy URL support is a behaviour change, so this ships as a minor rather than a patch. The description's references to 4.6.1, including the "After merge" step, should read 4.7.0.

Re-verified on b399256:

• npm run build:release passes.
• npm test: 54 passing, including the 4 new proxy-agent tests, and 1 failing (Acquisition SDK › disables api calls on unsuccessful response). That's the same failure the description already reports on master.
• The redirect handler is correct: superagent's _redirect sets this.url to the new location before it emits redirect, so getProxyAgent(proxiedRequest.url) picks the agent for the redirect target.

🤖 Generated with Claude Code

[revopushbot]

Review pass on 3335cfb: simplifier, code-review high --fix, comment cleanup.

Fixed

• Proxy credentials in errors: the unsupported-protocol error used to include the full proxy URL, so pac+http://user:secret@… printed the password. The message now strips the username and password, and a new test checks it.
• Redirect re-pick had no test: added a test with a local proxy that answers a plain-HTTP request with a 302 to https://… and checks that the next request tunnels (CONNECT) to the new host. It fails without the redirect listener.
• try scope: narrowed to the one call that can throw.
• Comments: shortened to match the rest of the codebase.

Not changed

• Code simplifier: no changes, the code was already minimal.
• PAC support: dropping it is the point of the PR. It's released as 4.7.0, so the release notes should call it out.
• Dispatching agent built on agent-base: a cleaner long-term design than the redirect listener, but it needs a new direct dependency, and the current approach is now tested.
• Lockfile patch bumps: ip-address 10.7.2 → 10.7.3 and socks 2.8.9 → 2.8.10 also landed. Both are harmless and only noted here.

Verification

• npm run build:release passes.
• npm test: 56 passing, 1 failing. The failing test, Acquisition SDK › disables api calls on unsuccessful response, also fails on master, which gives 50 passing and 1 failing.

🤖 Generated with Claude Code