build(deps): Bump form-data from 3.0.4 to 3.0.5 in /packages/ethereum-storage

[dependabot]

Bumps form-data from 3.0.4 to 3.0.5.

Changelog

Sourced from form-data's changelog.

v3.0.5 - 2026-06-12

Commits

• [Fix] escape CR, LF, and " in field names and filenames 8777e67
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape27c61a5
• [Deps] update hasown6a8a1c6

Commits

• be3f3cf v3.0.5
• 6a8a1c6 [Deps] update hasown
• 27c61a5 [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape
• 8777e67 [Fix] escape CR, LF, and " in field names and filenames
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

Greptile Summary

This PR bumps form-data from 3.0.4 to 3.0.5 in the packages/ethereum-storage package. The update is a security-relevant patch that fixes improper escaping of CR, LF, and " characters in field names and filenames in multipart form data.

• The version bump is a one-line change in package.json, pinning the exact patch version.
• The fix addresses a character-escaping issue in form-data that could allow header injection via crafted field names or filenames in multipart requests.

Confidence Score: 5/5

Safe to merge — this is a minimal, well-scoped patch update that fixes a character-escaping bug with no breaking changes.

The change is a single-line version pin update for a patch release of form-data. The patch corrects escaping of CR, LF, and double-quote characters in multipart field names and filenames, which is a hardening fix with no API changes. The risk of regression is very low.

No files require special attention.

Important Files Changed

Filename	Overview
packages/ethereum-storage/package.json	Single-line patch bump of form-data from 3.0.4 to 3.0.5; addresses CR/LF/quote escaping in multipart field names and filenames.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Client as ethereum-storage
participant FD as form-data@3.0.5
participant IPFS as IPFS/HTTP endpoint
Client->>FD: append(fieldName, value, filename)
Note over FD: Escape CR, LF, " in fieldName & filename
FD->>IPFS: multipart/form-data request
IPFS-->>Client: response

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Client as ethereum-storage
participant FD as form-data@3.0.5
participant IPFS as IPFS/HTTP endpoint
Client->>FD: append(fieldName, value, filename)
Note over FD: Escape CR, LF, " in fieldName & filename
FD->>IPFS: multipart/form-data request
IPFS-->>Client: response

Loading

_{Reviews (1): Last reviewed commit: "build(deps): Bump form-data in /packages..." | Re-trigger Greptile}