Bump form-data to fix critical vulnerabilities #182 & #183

[aparnajyothi-y]

This PR upgrades the form-data dependency to version 4.0.4 using npm audit fix, resolving a critical security vulnerability identified as GHSA-fjxv-7rqg-78g4.

Vulnerability Summary
form-data previously used Math.random() to generate boundary values for multipart form-encoded data. Because Math.random() is a pseudo-random number generator, it can be predicted if an attacker:

Can observe outputs of Math.random() in the application (e.g., via request headers), and

Can control at least one field in a form-data request.

This predictability allows an attacker to guess the multipart boundary, enabling them to inject additional fields or override values in downstream requests, leading to potential manipulation of internal services.

Affected Package
Package: form-data

Vulnerable Versions: < 2.5.4

Fixed Version: >= 2.5.4 (current version after fix: 4.0.4)

Resolution
This PR brings in the fix by allowing npm audit fix to bump the form-data version to 4.0.4, which no longer uses Math.random() and includes proper randomization for multipart boundaries.

Related issue:
dependabot alert #182
dependabot alert #183

[Copilot]

Pull Request Overview

This PR upgrades the form-data package to version 4.0.4 to address critical security vulnerabilities (GHSA-fjxv-7rqg-78g4) where Math.random() was used for boundary generation, making multipart forms predictable to attackers.

• Updated form-data from vulnerable versions to 4.0.4 which uses proper randomization
• Included transitive dependency updates from npm audit fix
• Added new license files for dependencies introduced by the security update

Reviewed Changes

Copilot reviewed 19 out of 22 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.licenses/npm/form-data-4.0.4.dep.yml	Updated form-data package version and metadata
.licenses/npm/form-data-2.5.5.dep.yml	Updated legacy form-data version metadata
.licenses/npm/undici.dep.yml	Minor version bump for undici dependency
.licenses/npm/brace-expansion.dep.yml	Patch version update for brace-expansion
Multiple new .licenses/npm/*.dep.yml files	License files for new transitive dependencies

[reneleonhardt]

Wouldn't it be easier to allow to dependabot to fix vulnerabilities and add audit to CI and a daily workflow?

On the other hand, without AI help like CodeRabbit not only dependabot PRs are not being reviewed and merged and stay open for months... 🤷