Bump form-data to bring in fix for critical vulnerability (#618)

Browse Source

The vulnerability:

    $ npm audit --audit-level=high
    # npm audit report

    form-data  >=4.0.0 <4.0.4 || <2.5.4
    Severity: critical
    form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
    form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
    fix available via `npm audit fix`
    node_modules/@azure/core-http/node_modules/form-data
    node_modules/@types/node-fetch/node_modules/form-data
    node_modules/form-data

    1 critical severity vulnerability

    To address all issues, run:
      npm audit fix

This change is the result of from running `npm audit fix` and then
using[1] to update licenses via `licensed cache`.

It doesn't look like `dependabot` previously raised any PRs for this
dependency, so this bumps it from `4.0.0` to `4.0.4`, see the
changelog[2] for details.

Link: https://github.com/licensee/licensed [1]
Link: https://github.com/form-data/form-data/blob/v4.0.4/CHANGELOG.md [2]

...

This commit is contained in:

Matthew Hughes

2025-08-13 12:02:46 -05:00

committed by GitHub

parent 8e57b58e57

commit e75c3e80bc

20 changed files with 2616 additions and 356 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

.licenses/npm/call-bind-apply-helpers.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/dunder-proto.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/es-define-property.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/es-errors.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/es-object-atoms.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/es-set-tostringtag.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/form-data-2.5.1.dep.yml → .licenses/npm/form-data-2.5.5.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/form-data-4.0.0.dep.yml → .licenses/npm/form-data-4.0.4.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/function-bind.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/get-intrinsic.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/get-proto.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/gopd.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/has-symbols.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/has-tostringtag.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/hasown.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/math-intrinsics.dep.yml

Generated

BIN

Binary file not shown.

.licenses/npm/safe-buffer.dep.yml

Generated

BIN

Binary file not shown.