[GOOD FIRST ISSUE] Update form-data to >= 4.0.4 to fix critical vulnerability in multiple examples

[ulises-jeremias]

Task

Update form-data to >= 4.0.4 across multiple examples to fix a critical arbitrary file read vulnerability. This is a dependency-only change — no logic changes needed.

---

Vulnerability

Advisory	Severity	Description
GHSA-fjxr-j6x5-9xcc	Critical	Prototype pollution via file metadata leading to arbitrary reads
GHSA-7xxf-gpj4-r4mq	Critical	Improper file path handling

Open Dependabot alerts: 14 (7 critical, 7 high)

---

Affected Examples

form-data appears as a transitive dependency in several examples through axios, node-fetch, or AWS SDK internals:

Example	Manifest
examples/kubernetes-tilt-dev/apps/node-nestjs-app	package-lock.json
examples/serverless-appsync-node-typescript	package-lock.json
examples/serverless-cognito-local	package-lock.json
examples/serverless-localstack-with-s3-and-dynamodb	pnpm-lock.yaml

---

Steps

1. Fork this repository
2. For each affected example, check the current version and dependency path:

   cd examples/<example>
   npm ls form-data

3. Add an npm override to force the patched version:

   // package.json
   "overrides": {
     "form-data": "^4.0.4"
   }

   For pnpm projects:

   "pnpm": {
     "overrides": {
       "form-data": "^4.0.4"
     }
   }

4. Run npm install (or pnpm install)
5. Verify:

   npm ls form-data        # should show >= 4.0.4
   npm audit | grep form-data  # should return 0

6. Open a PR with the updated lock files and package.json overrides

---

Validation

npm audit --json | python3 -c "
import json, sys
d = json.load(sys.stdin)
fd = {k: v for k, v in d.get('vulnerabilities', {}).items() if 'form-data' in k}
print('form-data vulnerabilities remaining:', len(fd))
"
# Expected: form-data vulnerabilities remaining: 0

---

Out of Scope

• Do not change any HTTP client code
• Do not update unrelated packages
• Keep the change focused on form-data overrides only

---

References

• GHSA-fjxr-j6x5-9xcc — form-data prototype pollution
• form-data releases
• npm overrides docs
• pnpm overrides docs