WHAT
bun audit flags a high-severity vulnerability in form-data (CVSS 7.5): GHSA-hmw2-7cc7-3qxx — unescaped multipart field names/filenames allow CRLF injection into multipart request boundaries. Affects form-data >=4.0.0 <4.0.6.
form-data is not a direct dependency here — it's pulled in transitively twice via @slack/web-api (through its axios dependency), so it can't be fixed with a simple direct version bump in package.json.
WHY
An attacker-influenced field name or filename passed through to a form-data-based multipart request (e.g. file uploads via the Slack API client) could inject arbitrary headers/fields into the multipart body, potentially smuggling extra form fields or corrupting the request. Worth patching proactively even though our direct usage surface is limited.
HOW
Force the fixed version tree-wide via a package.json "overrides" entry pinning form-data to ^4.0.6, then regenerate bun.lock. This is a non-breaking patch-level bump with no API changes. Verified: bun audit clean, bun run type-check passes, bun test 176/176 passing.
Fix is ready as a draft PR: #74. Opening this issue per CONTRIBUTING.md / CLAUDE.md policy so the PR has a linked, triaged issue before requesting the ready-for-pr label.
WHAT
bun auditflags a high-severity vulnerability inform-data(CVSS 7.5): GHSA-hmw2-7cc7-3qxx — unescaped multipart field names/filenames allow CRLF injection into multipart request boundaries. Affectsform-data >=4.0.0 <4.0.6.form-datais not a direct dependency here — it's pulled in transitively twice via@slack/web-api(through itsaxiosdependency), so it can't be fixed with a simple direct version bump in package.json.WHY
An attacker-influenced field name or filename passed through to a
form-data-based multipart request (e.g. file uploads via the Slack API client) could inject arbitrary headers/fields into the multipart body, potentially smuggling extra form fields or corrupting the request. Worth patching proactively even though our direct usage surface is limited.HOW
Force the fixed version tree-wide via a
package.json"overrides"entry pinningform-datato^4.0.6, then regeneratebun.lock. This is a non-breaking patch-level bump with no API changes. Verified:bun auditclean,bun run type-checkpasses,bun test176/176 passing.Fix is ready as a draft PR: #74. Opening this issue per CONTRIBUTING.md / CLAUDE.md policy so the PR has a linked, triaged issue before requesting the
ready-for-prlabel.