Update jest, cypress packages to resolve security issues caused by form-data

[elsamaryv]

Fixes a critical security vulnerability related to form-data dependency.

@miq-bot add-label dependencies

[GilbertCherrie]

@elsamaryv one small fix, can you please put this in alphabetical order.

[GilbertCherrie]

Also, I believe form-data 2.5.5 also contains the fix. Can we upgrade to that version instead to prevent such a big version jump from 2.3.3.

[Fryguy]

Is there a way to do this without using resolutions? (IMO resolutions only should be used as a last resort). If we can update jest/jest-cli, perhaps newer versions support the right version range

[GilbertCherrie]

Yeah @elsamaryv can you first try to upgrade the jest and jest-cli packages then see if it upgrades the form data package. If you are able to upgrade jest and jest-cli see what the most recent version you can get to for those without anything breaking and then see if that causes form-data to upgrade also.

[elsamaryv]

I updated the Jest and Cypress packages that previously included form-data via transitive dependencies. With these updates, form-data resolves to the patched versions 3.0.4 and 4.0.4. However, upgrading jest-cli causes multiple test/suite failures, so I had to retain the current version, which still depends on the vulnerable [email protected].

Running yarn why form-data shows:

[jrafanie]

Close / open after revert of #9505 via #9553

[jrafanie]

@Fryguy thoughts on spassky/yes
#9539 updates cypress/jest for form-data
#9554 adds flashClassMap
#9557 depends on flashClassMap

[jrafanie]

@Fryguy thoughts on spassky/yes
#9539 updates cypress/jest for form-data
#9554 adds flashClassMap
#9557 depends on flashClassMap

he said, yup, add the labels 😉

[Fryguy]

Backported to spassky in commit 961248a.

commit 961248a8a2ccb92819a216d44c3ea6c2916a4321
Author: Gilbert Cherrie <[email protected]>
Date:   Mon Aug 18 10:49:18 2025 -0400

    Merge pull request #9539 from elsamaryv/update-form-data
    
    Update jest, cypress packages to resolve security issues caused by form-data
    
    (cherry picked from commit 5cb4543dbd3f9ce0802637b14a984893e8aa3607)