fix: [form-data] Upgrade form-data from 2.3.3 to 2.5.6 to resolve CVE-2025-7783 (Predictable Boundary)

[devin-ai-integration]

Summary

Fixes the Predictable Value Range from Previous Values vulnerability in form-data@2.3.3 (CVSS 9.4, CVE-2025-7783). form-data uses Math.random() to generate multipart boundaries; an attacker able to observe earlier boundary values can predict subsequent ones and inject/forge multipart parts (parameter cloaking).

form-data@2.3.3 is transitive (tap > coveralls > request > form-data). Bumping the deep parent (tap) would be a multi-major change, so this pins the dependency via an npm overrides entry to the patched 2.5.x line:

+"overrides": {
+  "form-data": "2.5.6"
+}

2.5.6 is the latest 2.x (API-compatible with request's expectations) and resolves both CVE-2025-7783 (fixed in 2.5.4) and the later CRLF-injection CVE-2026-12143 (fixed in 2.5.6). package-lock.json regenerated → single form-data@2.5.6 resolution.

Verified locally: snyk test parses the lockfile and reports 0 remaining form-data vulnerabilities (was the 9.4 critical + a medium).

• Severity: Critical (CVSS 9.4) · CWE-330 (Use of Insufficiently Random Values)
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-7783
• Advisory: https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150
• Snyk scan: org 9e26acce-22c7-4efc-b470-21d9587f49fe, project goof (npm)

One vulnerability per PR; part of a set of 5 fix PRs for the top findings.

Link to Devin session: https://app.devin.ai/sessions/d6b18d8e5ad94506b760971485ceb694
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring