Fix critical CVE in form-data package (GHSA-fjxv-7rqg-78g4) (#589) (#591)

* Fix critical CVE in form-data package (GHSA-fjxv-7rqg-78g4)

Updated form-data across multiple packages to address critical security
vulnerability where unsafe random function was used for choosing
boundary
values.

Vulnerability Details:
- Advisory: GHSA-fjxv-7rqg-78g4
- Severity: Critical
- CWE-330: Use of Insufficiently Random Values
- Affected versions: <2.5.4, 3.0.0-3.0.3, 4.0.0-4.0.3

Packages Updated:
- code/package-lock.json
- code/extensions/che-activity-tracker/package-lock.json
- code/extensions/che-api/package-lock.json
- code/extensions/che-commands/package-lock.json
- code/extensions/che-port/package-lock.json
- code/extensions/che-remote/package-lock.json

The form-data package is used as a transitive dependency through:
- @types/node-fetch
- axios
- jsdom

Verification: npm audit confirms the critical form-data vulnerability
has been resolved. Vulnerability count reduced from 14 to 13.

Generated-by: Claude CLI

🤖 Generated with [Claude Code](https://claude.com/claude-code)



* Fix critical CVE in form-data package (GHSA-fjxv-7rqg-78g4)



* Fix critical CVE in form-data package (GHSA-fjxv-7rqg-78g4)



* Fix critical CVE in form-data package (GHSA-fjxv-7rqg-78g4)



* Fix critical CVE in form-data package (GHSA-fjxv-7rqg-78g4)



* Fix critical CVE in form-data package (GHSA-fjxv-7rqg-78g4)



* update che devworkspace-generator version



---------

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: sbouchet

code/extensions/che-activity-tracker/package-lock.json

@@ -39,6 +39,11 @@
     "jest": "27.3.1",
     "ts-jest": "^27.1.4"
   },
+  "overrides": {
+    "jsdom": {
+      "form-data": "3.0.4"
+    }
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/che-incubator/che-code.git"

code/extensions/che-activity-tracker/package.json

@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@devfile/api": "^2.3.0-1738854228",
-    "axios": "^1.7.4",
+    "axios": "^1.13.1",
     "@kubernetes/client-node": "^0.22.0",
     "fs-extra": "^11.2.0",
     "inversify": "^6.0.2",
@@ -53,6 +53,12 @@
     "jsonpath-plus": "10.1.0",
     "request": {
       "form-data": "2.5.5"
+    },
+    "@types/node-fetch": {
+      "form-data": "4.0.4"
+    },
+    "jsdom": {
+      "form-data": "3.0.4"
     }
   },
   "repository": {