fix(deps): upgrade tap to ^18.8.0 to remove form-data 2.3.3 — CVE-2025-7783 (predictable multipart boundary)

[devin-ai-integration]

Summary

Remediates Predictable Value Range from Previous Values in form-data@2.3.3 (SNYK-JS-FORMDATA-10841150 / CVE-2025-7783, severity Critical, CVSS 9.4): form-data used Math.random() for multipart boundaries, allowing parameter/boundary injection. It is reachable only through tap@11.1.5 > coveralls@3.0.9 > request@2.88.0 > form-data@2.3.3 (request is deprecated and pins form-data ~2.3.2, so no in-range update exists). Snyk's remediation for this path is tap@18.0.0; this PR takes that path.

- "tap": "^11.1.3",
+ "tap": "^18.8.0",

• Affected: form-data < 2.5.4 / 3.0.0–3.0.3 / 4.0.0–4.0.3 — Fixed in: 2.5.4, 3.0.4, 4.0.4. After this change form-data, request, coveralls and nyc are no longer in the dependency graph at all.
• The same removal also eliminates the tap > nyc > istanbul-lib-instrument > babel-traverse@6.26.0 path (CVE-2023-45133, Critical 9.3, no in-range fix) and the dev-only nyc > istanbul-reports > handlebars@4.0.11 copy.
• Advisory: https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150 · https://nvd.nist.gov/vuln/detail/CVE-2025-7783
• tap is declared in dependencies but is not require()d anywhere in the app; tap@18.8.0 (engines.node: 16>=16.17 || 18>=18.6 || >=20) is compatible with the Dockerfile's node:18.13.0 and the local Node 20.

Files changed: package.json, package-lock.json (large diff: tap 11→18 swaps its whole subtree — 372 added / 397 removed packages).

Verification: npm ci clean; require('tap') loads; 30/30 end-to-end regression checks pass (todo CRUD, login/session, HBS/EJS/Dust views, CSV+ZIP import, /chat, /users via MySQL). Post-change Snyk SCA at critical threshold: form-data and babel-traverse findings gone, no new critical findings introduced (16 remaining, all pre-existing on other paths).

Scan reference: Snyk MCP snyk_sca_scan (org 9e26acce-22c7-4efc-b470-21d9587f49fe) on main@d240896, 2026-09-10.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/0b602fbece0246d2a263a9d20b275733
Open in Devin Desktop: https://app.devin.ai/desktop/session/0b602fbece0246d2a263a9d20b275733?variant=devin
Requested by: @sumitshatwara

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring