fix: [form-data] Upgrade form-data from 2.3.3 to 4.0.4 to resolve CVE-2025-7783 - #225
fix: [form-data] Upgrade form-data from 2.3.3 to 4.0.4 to resolve CVE-2025-7783#225hannahhuh-cog wants to merge 1 commit into
Conversation
Co-Authored-By: Hannah Huh <hannah.huh@cognition.ai>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "overrides": { | ||
| "form-data": "4.0.4" | ||
| } |
There was a problem hiding this comment.
🟡 Lockfile out of sync with declared overrides
package.json declares an overrides block forcing form-data to 4.0.4, but the committed package-lock.json root node (packages[""]) contains no matching overrides key. The two files are out of sync, so npm ci fails with an EUSAGE error and npm install rewrites the lockfile.
Prompt for agents
The package.json adds an overrides block for form-data, but the committed package-lock.json does not record this in its root packages[""] node (there is no "overrides" key anywhere in the lockfile). npm normally persists the overrides object into the lockfile root when regenerating, so its absence indicates the lockfile is out of sync with package.json. This can cause `npm ci` to fail with an EUSAGE 'package.json and package-lock.json are in sync' error. Regenerate the lockfile from scratch (e.g. delete package-lock.json and run npm install, or run npm install so npm writes the overrides object into packages[""]), and commit the fully regenerated lockfile.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Verified locally — npm ci is not broken by this.
I regenerated the lockfile with npm install --package-lock-only on npm 10.8.2. This repo's lockfile is lockfileVersion: 2 (hybrid v1/v2), and npm did not write an overrides key into packages[""] — but it did resolve the overridden version in the tree, and npm only enforces the overrides-sync check when the lockfile records one.
Evidence, from a clean checkout of just package.json + package-lock.json on this branch:
$ npm ci --ignore-scripts
added 947 packages in 5s
$ node -e "console.log(require('form-data/package.json').version)"
4.0.4
No EUSAGE error. Leaving the lockfile as npm generated it.
| "overrides": { | ||
| "form-data": "4.0.4" | ||
| } |
There was a problem hiding this comment.
📝 Info: form-data 4.x forced onto request@2.88.0
The override pins form-data 4.0.4 onto request@2.88.0, which declares ~2.3.2. The APIs request uses (append, getHeaders, getLength, pipe) exist in v4, so it is unlikely to break, but this is a two-major-version jump across a transitive consumer.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Summary
Fixes predictable multipart boundary generation in
form-data, reported by the scheduled Snyk MCP scan.SNYK-JS-FORMDATA-10841150form-data@2.3.3(transitive)2.5.4,3.0.4,4.0.4; pinned to4.0.4Math.random()are predictable, so an attacker who controls part of a request body can inject additional multipart parts (parameter/HTTP request smuggling into upstream services).form-datais transitive, so the fix is an npmoverridesentry:package-lock.jsonregenerated withnpm install --package-lock-only; resolvednode_modules/form-datais now4.0.4.Snyk scan reference:
snyk test --all-projects --dev/snyk_sca_scan(unmanaged: true), Snyk org9e26acce-22c7-4efc-b470-21d9587f49fe.Devin-Org: engineering
Link to Devin session: https://app.devin.ai/sessions/fc1965e7d98f4966bea1c7aa64a929b0
Requested by: @hannahhuh-cog