build(deps): bump form-data from 4.0.5 to 4.0.6#205
Conversation
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![lifeomic-review-bot[bot]](https://avatars.githubusercontent.com/u/29172293?s=60&v=4){kind=small}
There was a problem hiding this comment.
Scope — Dependabot refreshes yarn.lock to resolve transitive form-data@^4.0.5 to 4.0.6 (from 4.0.5); package.json is unchanged and this is lockfile-only scope per changedFiles. The patch includes upstream escaping fixes for CR, LF, and " in multipart field names and filenames, which is worthwhile dependency hygiene for HTTP multipart handling in this library.
Upstream: form-data/form-data v4.0.6 (Dependabot links compare v4.0.5...v4.0.6; no upstream PR/issue number in metadata)
CI — Checks were still pending at review time; branch protection will gate merge on required checks.
Regression risk — Patch semver on a transitive dependency with no application source edits; risk is low though downstream packages that relied on prior escaping behavior should be covered by existing CI.
Residual risks / follow-ups
None — because the diff is confined to yarn.lock, securitySensitivePaths is empty, §2.9 does not apply to dependency-only lockfile refreshes, and the bump is a small patch with a targeted multipart escaping fix rather than a major API change.
Note: Review generated using Cursor model
composer-2.5.
This review was generated by review-bot.
Bumps form-data from 4.0.5 to 4.0.6.
Changelog
Sourced from form-data's changelog.
Commits
64190dbv4.0.692ae0eb[Deps] updatehasown,mime-typesf31d21e[Dev Deps] update@ljharb/eslint-config,auto-changelog,tape8dff42c[Fix] escape CR, LF, and"in field names and filenames67b0f65[Dev Deps] updatejs-randomness-predictorDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.