SEC-2309: sync fork with upstream (resolves form-data CVE)

[himynameisang]

https://simondata.atlassian.net/browse/SECURITY-2309

Summary

This fork was 30 commits behind imlewc/metabase-server upstream. Rather than carrying a standalone dependency bump on stale code, this syncs the fork:

• Merged upstream/main (30 commits) — conflicts in .gitignore, package.json (name/description, axios version), and package-lock.json, all resolved.
• Kept axios at ^1.14.0 (this branch's existing fix) rather than reverting to upstream's ^1.8.2 — axios 1.8.2 only requires form-data: ^4.0.0, which still covers the vulnerable range; 1.14.0 requires ^4.0.5. So the upstream sync alone would NOT have resolved this CVE (unlike the similar sync done for mcp-server-salesforce/SECURITY-2312) — the axios bump still needed to survive the merge.
• form-data resolves to 4.0.6, resolving ORCA-8368351 (CVE-2025-7501).
• Regenerated package-lock.json against the public npm registry (not Radico's internal Artifactory proxy) so it resolves consistently regardless of local .npmrc config.
• Dockerfile's earlier npm install → npm ci fix (fail fast on lockfile drift) survived the merge untouched.

This also brings in upstream work this fork was missing: new response formatters (src/formatters.ts), a response logger, an @modelcontextprotocol/sdk bump (^0.6.1 → ^1.25.2), and test coverage (test/formatters.test.js).

Blast radius

Contained: dependency versions + new upstream source files (additive formatters/logging, no Radico-specific logic changed beyond the package name and axios version conflict resolutions).

Testing

• npm run build — clean
• node --test test/formatters.test.js — 4/4 passing (upstream's own npm test script has a pre-existing glob bug — test/**/*.test.js doesn't expand under sh, reproduced identically on unsynced upstream/main, unrelated to this change)
• npm audit — 0 vulnerabilities

Risk

This is moderately risky, but I'm feeling confident — it's a large diff by line count, but it's almost entirely upstream code, plus a few small, well-understood conflict resolutions on our side.

Reviews

• An engineer must approve this change.

Adding new dependencies

Note: no new dependencies added. @modelcontextprotocol/sdk bumped to the version upstream already adopted; axios stays at this branch's existing ^1.14.0 (higher than upstream's ^1.8.2, intentionally, per above); form-data is a transitive bump that comes along with it.

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[Copilot]

Pull request overview

This PR addresses a security finding by updating the transitive form-data dependency to a patched release and tightening Docker build reproducibility by using npm ci instead of npm install.

Changes:

• Updated form-data from 4.0.2 to 4.0.6 in package-lock.json (including associated dependency updates like hasown and mime-types).
• Changed the Docker build dependency install step from npm install to npm ci to enforce lockfile consistency during image builds.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package-lock.json	Bumps form-data to 4.0.6 (and updates related transitive deps) to address CVE-2025-7501.
Dockerfile	Switches dependency installation to npm ci to ensure deterministic installs and fail fast on lockfile issues.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 9 changed files in this pull request and generated 8 comments.

Comments suppressed due to low confidence (1)

src/index.ts:1004

• execute_query sends template_tags (underscore) in the dataset request body, but elsewhere in this file (tool descriptions / update_card schema) the Metabase field is documented as template-tags (hyphenated). If Metabase expects the hyphenated key, template variable support will break.

              type: "native",
              native: {
                query: query,
                template_tags: {}
              },