Possible fix(deps): 56 vulnerable dependencies in package-lock.json

[begininvoke]

I think there may be a problem in demos/react18/cra-pwa/package-lock.json around line 8294.

CVE-2025-7783 is a critical insufficiently random value vulnerability in form-data v3.0.1 that enables HTTP Parameter Pollution (HPP). By exploiting predictable boundary strings or internal state generation during multipart/form-data assembly, attackers can inject duplicate or malformed parameters, potentially bypassing input validation, desynchronizing downstream services, or executing request smuggling attacks. The risk level is CRITICAL due to the direct impact on request integrity and potential for authentication/authorization bypasses.

Something like this might fix it:

Update the form-data dependency to the patched version in package.json and regenerate the lockfile.
--- a/demos/react18/cra-pwa/package.json
+++ b/demos/react18/cra-pwa/package.json
@@ -...
         "dependencies": {
           ...
-          "form-data": "3.0.1",
+          "form-data": "^3.0.4",
           ...
         }
After applying this change, run npm install to resolve and update package-lock.json with the fixed version.

For reference: rule CVE-2025-7783. Rated critical.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.