[matthewhughes934]

The vulnerability:

$ npm audit --audit-level=high
# npm audit report

form-data  >=4.0.0 <4.0.4 || <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
fix available via `npm audit fix`
node_modules/@azure/core-http/node_modules/form-data
node_modules/@types/node-fetch/node_modules/form-data
node_modules/form-data

1 critical severity vulnerability

To address all issues, run:
  npm audit fix

This change is the result of from running npm audit fix and then
using[1] to update licenses via licensed cache.

It doesn't look like dependabot previously raised any PRs for this
dependency, so this bumps it from 4.0.0 to 4.0.4, see the
changelog[2] for details.

Link: https://github.com/licensee/licensed [1]
Link: https://github.com/form-data/form-data/blob/v4.0.4/CHANGELOG.md [2]

[reneleonhardt]

CodeRabbit hasn't been enabled, is there a security team to speed-up reviews manually?
CI is frozen because of one vulnerablity, so nothing can be merged except this fix.
#460

[matthewhughes934]

I forgot to npm run build, done that and squashed into the commit

[matthewhughes934]

Ok, that CI failure took a bit to figure out:

• Here's the action https://github.com/actions/setup-go/blob/8e57b58e57be52ac95949151e2777ffda8501267/.github/workflows/licensed.yml, and that just calls
• https://github.com/actions/reusable-workflows/blob/95d9656793415e47f574f7967f3850ea3bf5a7ed/.github/workflows/licensed.yml

so I had to figure out to go and install https://github.com/licensee/licensed/tree/3.9.0 (same version as used by the action above) and run license cache. This should probably be documented somewhere.