Update form-data to 4.0.4 and add dependency overrides #76
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the form-data package to version 4.0.4 with exact version pinning (removing the caret) and introduces a new overrides section to enforce specific versions of axios (~1.10.0) and form-data (4.0.4) across all transitive dependencies. This appears to be a security or compatibility fix targeting nested dependencies from @contentstack packages.
Key changes:
- Pinned
form-datato exact version 4.0.4 (from ^4.0.0) - Added
overridessection to force axios ~1.10.0 and form-data 4.0.4 across all nested dependencies - Updated package-lock.json to reflect the new dependency resolution, including axios 1.10.0 for multiple @contentstack packages
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| package.json | Updated form-data to exact version 4.0.4 and added overrides section for axios and form-data |
| package-lock.json | Reflected resolved versions: form-data 4.0.4 and axios 1.10.0 across dependency tree, removed top-level axios entry |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "axios": "~1.10.0", | ||
| "form-data": "4.0.4" |
There was a problem hiding this comment.
Axios is not listed as a direct dependency of this package, but is being overridden here. The override affects only transitive dependencies from @contentstack packages. If axios 1.10.0 doesn't exist (see previous comment), this override will cause installation failures. Additionally, overriding transitive dependencies can lead to maintenance challenges and should only be done when addressing specific security vulnerabilities or critical bugs. Consider documenting why this override is necessary, or removing it if it's not essential.
| "axios": "~1.10.0", | |
| "form-data": "4.0.4" | |
| "axios": "~1.10.0" |
| "dotenv": "^16.4.7", | ||
| "express": "^4.21.1", | ||
| "form-data": "^4.0.0", | ||
| "form-data": "4.0.4", |
There was a problem hiding this comment.
The form-data dependency has been pinned to an exact version (4.0.4) by removing the caret (^) operator. While this ensures consistent builds, it may prevent receiving patch updates that could include bug fixes or security patches. Consider whether this strict pinning is necessary, or if using "^4.0.4" would be more appropriate to allow automatic patch-level updates while maintaining compatibility.
| "form-data": "4.0.4", | |
| "form-data": "^4.0.4", |
No description provided.