From 296b77034291ca68a612be2d5de60db3ddcb0ec6 Mon Sep 17 00:00:00 2001
From: Yos Riady <yos@formo.so>
Date: Mon, 3 Aug 2026 16:42:43 +0700
Subject: [PATCH] Fix Aikido dependency findings: form-data and zod
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pnpm-workspace.yaml overrides:
- form-data >=4.0.6 <5: CRLF injection via multipart field names /
  filenames (CVE-2026-12143, HIGH; axios transitive).
- zod >=4.4.0 <5: prototype pollution + missing input validation
  (AIKIDO-2026-10706/-10707; @modelcontextprotocol/server transitive).

Verified: tsc build, typecheck, eslint clean; mocha 191 passing /
1 pending (the healthy split — live API tests ran, not skipped).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 pnpm-lock.yaml      | 30 ++++++++++++++++++++----------
 pnpm-workspace.yaml |  6 ++++++
 2 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ee5a7d4..b5bf717 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,6 +6,8 @@ settings:
 
 overrides:
   serialize-javascript: '>=7.0.5'
+  form-data: '>=4.0.6 <5'
+  zod: '>=4.4.0 <5'
 
 patchedDependencies:
   incur@0.4.26: ae18879675f35e842cb43134909e7abd7d02f4268e1d733be25fd99a79bb78d1
@@ -637,8 +639,8 @@ packages:
     resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
     engines: {node: '>=14'}
 
-  form-data@4.0.5:
-    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+  form-data@4.0.6:
+    resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
     engines: {node: '>= 6'}
 
   fsevents@2.3.3:
@@ -697,6 +699,10 @@ packages:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
   he@1.2.0:
     resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==}
     hasBin: true
@@ -1009,8 +1015,8 @@ packages:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
-  zod@4.3.6:
-    resolution: {integrity: sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==}
+  zod@4.4.3:
+    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
 
 snapshots:
 
@@ -1150,7 +1156,7 @@ snapshots:
 
   '@modelcontextprotocol/server@2.0.0-alpha.4':
     dependencies:
-      zod: 4.3.6
+      zod: 4.4.3
 
   '@pkgjs/parseargs@0.11.0':
     optional: true
@@ -1307,7 +1313,7 @@ snapshots:
   axios@1.18.0:
     dependencies:
       follow-redirects: 1.16.0
-      form-data: 4.0.5
+      form-data: 4.0.6
       https-proxy-agent: 5.0.1
       proxy-from-env: 2.1.0
     transitivePeerDependencies:
@@ -1543,12 +1549,12 @@ snapshots:
       cross-spawn: 7.0.6
       signal-exit: 4.1.0
 
-  form-data@4.0.5:
+  form-data@4.0.6:
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.2
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   fsevents@2.3.3:
@@ -1609,6 +1615,10 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
   he@1.2.0: {}
 
   https-proxy-agent@5.0.1:
@@ -1632,7 +1642,7 @@ snapshots:
       '@toon-format/toon': 2.1.0
       tokenx: 1.3.0
       yaml: 2.8.3
-      zod: 4.3.6
+      zod: 4.4.3
 
   is-extglob@2.1.1: {}
 
@@ -1904,4 +1914,4 @@ snapshots:
 
   yocto-queue@0.1.0: {}
 
-  zod@4.3.6: {}
+  zod@4.4.3: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 200351c..7884d19 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -3,6 +3,12 @@ blockExoticSubdeps: true
 
 overrides:
   serialize-javascript: '>=7.0.5'
+  # form-data <4.0.6: CRLF injection via field names/filenames
+  # (CVE-2026-12143, HIGH; axios transitive).
+  'form-data': '>=4.0.6 <5'
+  # zod <4.4.0: prototype pollution + missing input validation
+  # (AIKIDO-2026-10706/-10707; @modelcontextprotocol/server transitive).
+  'zod': '>=4.4.0 <5'
 
 allowBuilds:
   esbuild: true