chore(deps): bump form-data from 4.0.5 to 4.0.6 - #142
Conversation
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![lifeomic-review-bot[bot]](https://avatars.githubusercontent.com/u/29172293?s=60&v=4){kind=small}
There was a problem hiding this comment.
Upstream: unknown (author to confirm)
Scope
This PR updates only yarn.lock, resolving the transitive form-data dependency from 4.0.5 to 4.0.6 (still satisfied via form-data@^4.0.5). The bump pulls in an upstream patch that escapes CR, LF, and " in multipart field names and filenames, improving correctness and hardening for consumers such as axios that use this library.
CI
CI is still pending; branch protection will gate merge on required checks.
Regression risk
Patch-level semver with a targeted encoding fix and no manifest or application source edits—low regression risk for this codebase.
Residual risks / follow-ups
None — because the change is lockfile-only, securitySensitivePaths is empty, and the resolved version remains within the existing ^4.0.5 range with no API surface changes in this repository.
Note: Review generated using Cursor model
composer-2.5.
This review was generated by review-bot.
Bumps form-data from 4.0.5 to 4.0.6.
Changelog
Sourced from form-data's changelog.
Commits
64190dbv4.0.692ae0eb[Deps] updatehasown,mime-typesf31d21e[Dev Deps] update@ljharb/eslint-config,auto-changelog,tape8dff42c[Fix] escape CR, LF, and"in field names and filenames67b0f65[Dev Deps] updatejs-randomness-predictorDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.