chore(deps): override form-data to ^4.0.6 (CVE fix)

[cliffhall]

Summary

Adds a form-data override to the root package.json so the transitive dev dependency resolves to >= 4.0.6, which contains the fix for the CRLF-injection vulnerability.

Before this change, form-data resolved to 4.0.5 via vitest -> jsdom. After the override, npm ls form-data --all shows only form-data@4.0.6:

@modelcontextprotocol/inspector-cli -> ./cli
  vitest@4.0.17
    jsdom@20.0.3
      form-data@4.0.6

The existing get-intrinsic override is preserved. No inspector version numbers were changed.

Resolves Dependabot alert 130

Part of #1706

Verification

All CI checks (mirroring .github/workflows/main.yml and cli_tests.yml) pass locally:

• npx prettier --check . — pass
• npm run check-version — pass
• cd client && npm run lint — pass
• cd client && npm test — pass (535 tests)
• cd cli && npm test — pass (85 tests)
• npm run build — pass

E2e tests were not run (require Playwright browser downloads).

🤖 Generated with Claude Code

https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

[cliffhall]

@claude review — security dependency fix adding a form-data override to ^4.0.6 (part of #1706). Verify it resolves the advisory, the override is correct/minimal, and nothing is broken. Flag anything actionable.

[claude]

Claude finished @cliffhall's task in 1m 35s —— View job

---

Review: form-data override (CVE fix)

• Read PR diff (package.json + package-lock.json)
• Verify the advisory is resolved by >= 4.0.6
• Check the override is correct & minimal
• Verify dependency tree / nothing broken
• Post review

Verdict: LGTM. The override is correct, minimal, and the tree resolves cleanly to a single patched form-data. No actionable issues found.

---

What I verified

1. Override is correct & minimal (package.json:80-83)

"overrides": {
  "get-intrinsic": "1.3.0",
  "form-data": "^4.0.6"
}

• Adds only the new key; the existing get-intrinsic override is preserved untouched. ✅
• ^4.0.6 is the right shape for a security floor — it pins the minimum patched version while still allowing future 4.x patches, rather than freezing a single build. (Minor stylistic note: get-intrinsic uses an exact pin and this uses a caret. That's an intentional/reasonable difference — a caret floor is preferable for CVE remediation — so no change needed.)

2. Tree resolves cleanly (package-lock.json)

• Exactly one form-data node in the lockfile, resolved to 4.0.6 (package-lock.json:7229-7245). No stray < 4.0.6 copies remain anywhere in the tree. ✅
• Sole consumer is jsdom@20.0.3 (form-data: "^4.0.0"), pulled in via vitest, and the node is marked "dev": true — so this is a dev/test-only dependency, never shipped in the published package. ✅
• The production node-fetch path uses formdata-polyfill, not form-data, so runtime output is unaffected. ✅

3. Side-effect bump is benign

• hasown moved 2.0.2 → 2.0.4 because form-data@4.0.6 requires hasown ^2.0.4. This is a patch-level bump of a small, stable package (just re-exports function-bind), so it's expected and low-risk. ✅
• No inspector version numbers changed, consistent with check-version. ✅

One caveat on the advisory itself

I was unable to independently confirm the advisory online — both WebSearch and WebFetch are blocked in this run (no granted permission), so I couldn't open the GHSA/Dependabot page. Based on the lockfile the fix is applied correctly: the previously-resolved 4.0.5 is replaced by 4.0.6, which the PR (and Dependabot alert 130) identify as the patched floor for the CRLF/boundary-injection issue. Since 4.0.6 is the current published form-data release and the whole tree now dedupes to it, this resolves the alert as described. If you want a hard confirmation, npm audit / the Dependabot alert status after merge is the authoritative check.

Suggestions (non-blocking)

• Nothing required. Optionally, once merged, confirm the Dependabot alert auto-closes and consider whether 4.0.4/4.0.5 were reachable elsewhere in #1706's scope (they aren't in this repo's tree).
  · deps/security-form-data