fix: pin form-data to 4.0.4+ to patch CVE-2025-7783

[hamzahalq]

Summary

• Resolves Dependabot alert selector limit #16 (critical): form-data used Math.random() for multipart boundary generation, allowing an attacker who can observe the PRNG output to predict and inject request parameters (CVE-2025-7783 / GHSA-fjxv-7rqg-78g4).
• form-data is a transitive dependency of axios. Added a resolutions pin (^4.0.4) rather than bumping axios directly, to keep this fix scoped to the flagged vulnerability. Lockfile now resolves form-data to 4.0.6.

Test plan

• yarn install completes cleanly
• yarn build succeeds

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 30961be1-2ab4-4709-ba55-ded99df6476f

📥 Commits

Reviewing files that changed from the base of the PR and between 4b74354 and 49aee11.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock, !*.lock, !yarn.lock

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

What changed

• Added a Yarn resolutions entry pinning transitive form-data to ^4.0.4.
• Lockfile resolves form-data to 4.0.6; axios remains unchanged.

Risk

• risk:low

Security-sensitive areas

• Mitigates CVE-2025-7783/GHSA-fjxv-7rqg-78g4 involving predictable multipart boundaries.

Test coverage impact

• No application test coverage changes.
• yarn install and yarn build completed successfully.

Operational concerns

• Deployment requires installing from the updated lockfile.
• Rollback can remove the resolution and regenerate the lockfile, subject to restoring the vulnerable dependency.

Walkthrough

package.json adds a top-level resolutions block pinning form-data to ^4.0.4.

Changes

Dependency resolution

Layer / File(s)	Summary
Add form-data resolution package.json	Adds a top-level resolution forcing form-data to version ^4.0.4.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: security, risk:high

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}