Possible fix(deps): 6 vulnerable dependencies in package-lock.json

This might be a false positive, but `package-lock.json` around line 10437 looked worth a second pair of eyes.

The form-data library inserts the `field` argument and `filename` option verbatim into the `Content-Disposition` header without escaping carriage‑return, line‑feed, or double‑quote characters. This CWE‑93 CRLF injection allows an attacker who can control multipart field names or filenames (e.g., via JSON keys) to terminate the header line and inject arbitrary headers or entire additional multipart parts. The attacker can thereby add or override form fields that downstream parsers see, potentially granting admin privileges or manipulating request data. The issue exists in version 2.3.3 (any version ≤4.0.5) and is fixed in form-data 2.5.6, 3.0.5, or 4.0.6 by escaping CR, LF, and ".

Something like this might fix it:

```diff
--- a/package-lock.json
+++ b/package-lock.json
@@ -10437,7 +10437,7 @@
"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz",
"integrity": "...",
- "version": "2.3.3"
+ "version": "2.5.6"
}
}
}
```

For reference: rule `CVE-2026-12143`. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*