fix: override form-data to resolve CRLF injection advisory

Pin form-data@4.0.6 for transitive deps from ibm-cloud-sdk-core and n8n-workflow, and extend the supply-chain check to verify the override is active.

Author: redanthrax

pnpm-lock.yaml

@@ -7,6 +7,7 @@ overrides:
   lodash: '4.18.1'
   uuid: '11.1.1'
   minimatch: '10.2.5'
+  form-data: '4.0.6'
   # npm dist-tag stable; block 2.23+ beta-channel releases
   n8n-workflow: '2.22.3'
 

pnpm-workspace.yaml

@@ -148,8 +148,15 @@ function verifyActivePnpmConfig() {
 			}
 		}
 
-		if (!config.includes('lodash=') || !config.includes('uuid=') || !config.includes('minimatch=')) {
-			errors.push('pnpm overrides for lodash/uuid/minimatch are not active — check pnpm-workspace.yaml');
+		if (
+			!config.includes('lodash=') ||
+			!config.includes('uuid=') ||
+			!config.includes('minimatch=') ||
+			!config.includes('form-data=')
+		) {
+			errors.push(
+				'pnpm overrides for lodash/uuid/minimatch/form-data are not active — check pnpm-workspace.yaml',
+			);
 		}
 	} catch (error) {
 		errors.push(`unable to read pnpm config: ${error.message}`);