Fix critical dependency vulnerabilities (form-data, tar)

[edward-beacon]

Summary

Resolves the open critical Dependabot alert (form-data, CVE-2025-7783) and a second critical that npm audit reports but Dependabot has not surfaced yet (tar, GHSA-23hp-3jrh-7fpw).

All affected packages are devDependencies. The published SDK (src/index.js) has no runtime dependencies, so none of these alerts affect consumers of the package. They do affect anyone running lint/test/coverage in this repo or CI.

Changes

File	Change	Why
package.json	Add overrides: { "form-data": "^2.5.6" }	form-data 2.3.3 is pinned by the deprecated request package (via coveralls), so npm cannot upgrade it on its own. The override forces the patched 2.5.6, which stays on the same 2.x line request expects.
package.json	ava ^6.2.0 → ^6.4.1	Stays within the existing semver range. ava 6.4.1 pulls @vercel/nft 0.29.x → @mapbox/node-pre-gyp 2.x → tar 7.5.22, replacing the unpatched tar 6.2.1.
package-lock.json	Regenerated with npm install

Verification

• npm run lint and npm test pass.
• npm audit: critical 3 → 0, total 29 → 26.
• Diffed the full set of advisory IDs before/after: 14 advisories removed, 0 introduced.

Dependabot alerts closed by this PR (11)

Alert	Package	Severity	Advisory
#8	form-data	critical	GHSA-fjxv-7rqg-78g4 / CVE-2025-7783
#44	form-data	high	GHSA-hmw2-7cc7-3qxx / CVE-2026-12143
#16	tar	high	GHSA-8qq5-rm4j-mr97
#17	tar	high	GHSA-r6q2-hw4h-h46w
#19	tar	high	GHSA-34x7-hfp2-rc4v
#20	tar	high	GHSA-83g3-92jg-28cx
#30	tar	high	GHSA-qffp-2rhf-9h96
#31	tar	high	GHSA-9ppj-qmqm-q256
#43	tar	medium	GHSA-vmf3-w455-68vh
#52	tar	medium	GHSA-w8wr-v893-vjvp
#38	picomatch 2.x	medium	GHSA-3v7f-55p6-f55p

Also fixed (in npm audit, not yet in Dependabot): tar GHSA-23hp-3jrh-7fpw (critical), GHSA-8x88-c5mf-7j5w (high), GHSA-r292-9mhp-454m (high), GHSA-gvwx-54wh-qm9j (medium).

---

⚠️ Remaining open alerts NOT addressed by this PR

25 Dependabot alerts remain open after this merge: 0 critical, 11 high, 13 medium, 1 low.
Full list: https://github.com/electionbuddy/electionbuddy-node/security/dependabot

This PR was intentionally scoped to the critical alerts. The rest need follow-up work:

High (11)

Package	Alerts	Advisory	Notes
brace-expansion 1.x / 2.x	#55, #62	GHSA-3jxr-9vmj-r5cp	npm audit fix can resolve
js-yaml 3.x / 4.x	#53, #54, #60, #61	GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj	3.x via coveralls, nyc, ava/supertap; 4.x via eslint. Needs 3.15.1 / 4.3.1
lodash	#40	GHSA-r5fr-rjxr-66jc	Needs 4.18.0
flatted	#33	GHSA-rf6f-7fwh-wjgh	Needs 3.4.2
minimatch 3.x / 10.x	#28, #27	GHSA-7r86-cg39-jmmj	Needs 3.1.3 / 10.2.3
glob 11.x	#14	GHSA-5j98-mcp5-4vw2	Needs 11.1.0

Medium (13)

Package	Alerts	Notes
js-yaml 3.x / 4.x	#12, #13, #47, #48	Same chains as above
lodash	#18, #39
uuid 3.x	#42	via request and nyc/istanbul-lib-processinfo
picomatch 4.x	#34	Needs 4.0.4
qs	#15	via request
tough-cookie	#4	via request
request	#3	No patch exists. request is deprecated and unmaintained.
yargs-parser	#1	via opn-cli → meow 3.x
@humanfs/node	#65	via eslint

Low (1)

Package	Alerts
@babel/core	#46

Recommended follow-ups (in priority order)

1. Remove coveralls. It depends on the deprecated request, which has an unfixable SSRF (#3) and drags in form-data, qs, tough-cookie, uuid@3, and js-yaml@3. It also appears unused: .travis.yml calls npm run coveralls, but no such script exists in package.json, and there is no GitHub Actions workflow in the repo. Removing it also lets the form-data override in this PR be deleted.
2. Replace opn-cli (unmaintained; pulls meow 3.x → trim-newlines, yargs-parser) with open-cli, or drop the opener from the report script.
3. Run npm audit fix for the remaining non-breaking updates (brace-expansion, minimatch, glob, picomatch, flatted, lodash, js-yaml, @humanfs/node, @babel/core). npm reports a fix available for all of them without semver-major changes.
4. Bump nyc 17 → 18 (semver-major) to clear the istanbul-lib-processinfo → uuid chain.
5. Enable Dependabot version updates for npm. .github/dependabot.yml only configures the devcontainers ecosystem, so Dependabot will raise security alerts but will never open update PRs for npm packages. Adding a package-ecosystem: "npm" entry would keep this from piling up again.

🤖 Generated with Claude Code