LTS-4004: bump form-data to patched releases (4.0.6 / 2.5.6) — fixes CRLF injection (GHSA-hmw2-7cc7-3qxx)

[prasadthx]

What

Bumps the transitive dev-dependency form-data to patched releases in the lockfile:

Copy	Before	After
top-level node_modules/form-data	4.0.4	4.0.6
@types/request/node_modules/form-data	2.5.5	2.5.6

Why

Resolves GHSA-hmw2-7cc7-3qxx — CRLF injection in form-data via unescaped multipart field names and filenames (CWE-93, CVSS 7.5).

Jira: LTS-4004

Notes

• form-data is not a direct dependency — it's pulled in transitively by dev tooling. Both vulnerable copies already satisfied the existing semver ranges (^4.0.0/^4.0.4 and ^2.5.5), so the patched versions are picked up without any package.json change. hasown@2.0.4 is added as a sub-dependency of form-data@4.0.6.
• This is a package-lock.json-only update, produced by npm update form-data --package-lock-only. No runtime or source code changes.

Why the diff is larger than just form-data

npm (v11) also reconciled a stale puppeteer-core subtree that was lingering in the lockfile. puppeteer-core is an optional peer dependency of webdriverio and is not used by this sample:

"peerDependencies":     { "puppeteer-core": ">=22.x || <=24.x" },
"peerDependenciesMeta": { "puppeteer-core": { "optional": true } }

The old lockfile had puppeteer-core@21.11.0 (and its private subtree: chromium-bidi, devtools-protocol, cross-fetch, unbzip2-stream, plus nested copies of ws/buffer/proxy-agent/@puppeteer/browsers) pinned even though nothing requires it. npm correctly drops it on reconciliation — npm ci against the new lockfile produces the same tree. Verified:

• all direct dependencies still resolve,
• no remaining package has a hard dependency on puppeteer-core (optional peer only),
• no dangling hard dependencies introduced.

🤖 Generated with Claude Code