Dashboardcraftgetsentry/craft: form-data has two tran…

getsentry/craft: form-data has two transitive copies requiring separate overrides

Category: pattern
Confidence: 1.00
ID: 019ef40b-f5eb-711a-857e-2c8eca980c70
Project ID: e16af391-c497-4837-b681-c849a5514499
Cross-project: No
Recalled in other projects: 0
Source session: 0fP87WobecR7pnIEl
Created: 2026-06-23 09:45:45
Updated: 2026-06-23 10:34:45

Content

Two copies of form-data in root pnpm-lock.yaml via different chains: (1) form-data@4.0.4 (High, GHSA-hmw2-7cc7-3qxx, Alert #178): @types/node-fetch@2.6.13form-data@4.0.4. Fix: "form-data@>=4": "^4.0.6" in pnpm.overrides. (2) form-data@2.5.5 (High, Alert #179): @google-cloud/storage@7.18.0retry-request@7.0.2@types/request@2.48.13form-data@2.5.5. Fix: "form-data@<3": "^2.5.6" in pnpm.overrides. Both overrides needed; one alone leaves the other copy vulnerable. form-data@4.0.6 and @2.5.6 confirmed on npm. Both overrides applied in branch byk/fix/dependabot-security-alerts.

Move to: