From 15bbbb33646da3b96a281a1afdc1cd1f5863311d Mon Sep 17 00:00:00 2001 From: Jackie Li Date: Tue, 16 Jun 2026 19:30:34 +0100 Subject: [PATCH] fix(deps): bump form-data 2.5.5 -> 2.5.6 to resolve GHSA-hmw2-7cc7-3qxx High-severity advisory (unsafe random boundary generation) in form-data < 2.5.6, pulled in transitively via @actions/cache -> @azure/ms-rest-js (form-data@^2.5.0). 2.5.6 satisfies the existing range; no direct dependency or package.json change needed. --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 2fa3ed6..06db9f7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1477,9 +1477,9 @@ for-each@^0.3.5: is-callable "^1.2.7" form-data@^2.5.0: - version "2.5.5" - resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.5.5.tgz#a5f6364ad7e4e67e95b4a07e2d8c6f711c74f624" - integrity sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A== + version "2.5.6" + resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.5.6.tgz#ef39b3d99e2fc9f25420c0db7962fe36cafcd244" + integrity sha512-Ogz/E85h9tlfJzpI6TuFpGcHZFhLrb9Gw8wq9v40CxSCPnv7ahKr6Xgtkn0KYCDQJ8DNn5VoMO8EXr9V5PadyA== dependencies: asynckit "^0.4.0" combined-stream "^1.0.8"