fix: update form-data lockfile resolution

[superdav42]

Summary

• Updated package-lock.json so the transitive form-data package resolves to 4.0.6.
• Refreshed the nested hasown metadata required by the updated form-data lockfile entry.
• Kept the dependency remediation scoped to the npm lockfile.

Testing

• node -e "const fs=require('fs'); const lock=JSON.parse(fs.readFileSync('package-lock.json','utf8')); const fd=lock.packages['node_modules/form-data']; console.log(JSON.stringify({version: fd && fd.version}, null, 2)); process.exit(fd && fd.version === '4.0.6' ? 0 : 1);"
• npm audit --json parsed with form-data=null (remaining audit findings are unrelated existing dependencies)
• git diff --check
• npm run lint:js (fails on existing unrelated asset lint errors)
• npm run lint:css (fails on existing unrelated assets/css/admin.css disabled-rule error)

Resolves #1548

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 345257ab-d20e-4901-b774-6d759bef6d8c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/auto-20260627-001756-gh1548

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[superdav42]

MERGE_SUMMARY

Implemented dependency alert remediation for #1548.

Summary:

• Updated package-lock.json so transitive form-data resolves to 4.0.6.
• Refreshed lockfile metadata for hasown required by the updated form-data dependency.

Verification:

• node -e ... confirmed lock.packages['node_modules/form-data'].version === '4.0.6'.
• npm audit --json parsed with form-data=null; remaining vulnerabilities are unrelated existing dependencies.
• git diff --check passed.
• npm run lint:js attempted; failed on unrelated existing asset lint issues.
• npm run lint:css attempted; failed on unrelated existing assets/css/admin.css disabled-rule error.

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password