From 0798de52e655956de6c9bd9129fae72c88c64e68 Mon Sep 17 00:00:00 2001
From: David Snelling <david@soulcraft.com>
Date: Tue, 5 Aug 2025 07:28:10 -0700
Subject: [PATCH] fix(security): resolve critical vulnerability in form-data
 dependency

- Add npm overrides to force form-data version 4.0.4 or higher
- Fixes GitHub security advisory GHSA-fjxv-7rqg-78g4
- Vulnerability was in transitive dependency via TensorFlow.js
- No functionality changes, all tests passing
---
 package-lock.json | 6 +++---
 package.json      | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e8158a59..724d38e3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6205,9 +6205,9 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.3.tgz",
-      "integrity": "sha512-qsITQPfmvMOSAdeyZ+12I1c+CKSstAFAwu+97zrnWAbIr5u8wfsExUzCesVLC8NgHuRUqNN4Zy6UPWUTRGslcA==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
diff --git a/package.json b/package.json
index 71ee7bd1..d2170492 100644
--- a/package.json
+++ b/package.json
@@ -48,6 +48,9 @@
   "engines": {
     "node": ">=24.4.0"
   },
+  "overrides": {
+    "form-data": "^4.0.4"
+  },
   "scripts": {
     "prebuild": "echo 'Prebuild step - no version generation needed'",
     "build": "BUILD_TYPE=unified rollup -c rollup.config.js",