Possible fix(deps): 6 vulnerable dependencies in package-lock.json

This might be a false positive, but `package-lock.json` around line 10437 looked worth a second pair of eyes.

The form-data library inserts the `field` argument and `filename` option verbatim into the `Content-Disposition` header without escaping carriage‑return, line‑feed, or double‑quote characters. This CWE‑93 CRLF injection allows an attacker who can control multipart field names or filenames (e.g., via JSON keys) to terminate the header line and inject arbitrary headers or entire additional multipart parts. The attacker can thereby add or override form fields that downstream parsers see, potentially granting admin privileges or manipulating request data. The issue exists in version 2.3.3 (any version ≤4.0.5) and is fixed in form-data 2.5.6, 3.0.5, or 4.0.6 by escaping CR, LF, and ".

Something like this might fix it:

```diff
--- a/package-lock.json
+++ b/package-lock.json
@@ -10437,7 +10437,7 @@
"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz",
"integrity": "...",
- "version": "2.3.3"
+ "version": "2.5.6"
}
}
}
```

For reference: rule `CVE-2026-12143`. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Inspect package-lock.json around line 10437 and confirm which form-data version is resolved. Check that the dependency is upgraded to a fixed version, then run the test suite and verify the lockfile remains consistent. Done means the vulnerable form-data version is no longer present and tests pass.

Vom Indexierungsmodell aus dem Issue-Text verfasst.