fix(deps): pin form-data to >=4.0.6 to address CRLF injection (GHSA-hmw2-7cc7-3qxx)

[shahariaazam]

Automated dependency-security fix (draft, awaiting proper triage)

Linked issue: #75

This PR is an automated security-patch sweep, equivalent to responding to a Dependabot alert. GitHub's Dependabot Alerts API was not reachable from the sandbox that produced this PR, so a local bun audit was run as a substitute.

This is opened as a draft and is NOT requesting immediate merge. Per this repo's CLAUDE.md constitution, every PR must be linked to a pre-triaged GitHub issue carrying the ready-for-pr label before it can be merged. Issue #75 has been opened to track this. A maintainer should triage it and apply the ready-for-pr label if this remediation path is acceptable, or close this PR if a different approach is preferred.

This PR does not claim to satisfy the issue-first policy on its own — it is left in draft specifically so it isn't merged before proper triage happens.

What / Why

bun audit reported one high severity advisory:

form-data  >=4.0.0 <4.0.6
  @slack/web-api › form-data
  high: form-data: CRLF injection in form-data via unescaped multipart field names and filenames
  https://github.com/advisories/GHSA-hmw2-7cc7-3qxx

form-data is a transitive dependency pulled in twice — once directly by @slack/web-api (resolved to 4.0.4) and once via @slack/web-api's axios dependency (resolved to 4.0.5). Both are within the vulnerable range >=4.0.0 <4.0.6.

How

Added a package.json "overrides" entry to force form-data to ^4.0.6 across the whole dependency tree (a patch-level bump, no breaking changes), then regenerated bun.lock via bun install.

"overrides": {
  "form-data": "^4.0.6"
}

Verification

• bun audit — now reports no vulnerabilities (was 1 high)
• bun run type-check — passes
• bun test — 176 pass / 0 fail (328 expect() calls)

Scope

No application code was touched — only package.json and bun.lock. No other actionable vulnerabilities were found in this sweep.

---

Generated by Claude Code