fix: [form-data] Upgrade form-data from 2.3.3 to 2.5.4 to resolve CVE-2025-7783

[hannahhuh-cog]

Summary

Forces the transitive dependency form-data 2.3.3 -> 2.5.4 via an npm overrides entry to remediate a Critical vulnerability flagged by the scheduled Snyk SCA scan. form-data is pulled in through tap > coveralls > request@2.88.0, and request pins form-data@~2.3.2, so a plain relock cannot reach the fixed version; Snyk's only alternative was upgrading tap 11 -> 18 (a major, breaking bump).

+  "overrides": {
+    "form-data": "2.5.4"
+  },

Vulnerability

• Title: Predictable Value Range from Previous Values (uses Math.random() for multipart boundary generation)
• CVE: CVE-2025-7783 · Snyk: SNYK-JS-FORMDATA-10841150
• Severity: Critical (CWE-330)
• Affected: form-data@2.3.3 introduced through tap@11.1.5 > coveralls@3.0.9 > request@2.88.0 > form-data@2.3.3
• Fixed in: 2.5.4 (also 3.0.4, 4.0.4)

Risk: predictable multipart boundaries allow an attacker who can observe other Math.random() outputs to inject extra parameters into multipart requests.

Verification: lockfile and runtime form-data both 2.5.4. Lockfile also gains 2.5.4's own small dependency subtree (es-set-tostringtag, hasown, etc.).

Snyk scan reference: Snyk MCP SCA scan of COG-GTM/nodejs-goof on 2026-09-14 (org 9e26acce-22c7-4efc-b470-21d9587f49fe).

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/387468bb0c6d4d6dbb7183fbbb24385f
Open in Devin Desktop: https://app.devin.ai/desktop/session/387468bb0c6d4d6dbb7183fbbb24385f?variant=devin
Requested by: @hannahhuh-cog

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.