cucadmuh ccb2d11fc4 fix(deps): bump transitive form-data to 4.0.6 (GHSA-hmw2-7cc7-3qxx) (#1118) ...

* fix(deps): bump transitive form-data to 4.0.6 (GHSA-hmw2-7cc7-3qxx)

Close Dependabot alert #18: axios pulls form-data for multipart bodies;
lockfile now pins the patched 4.0.6 release (CVE-2026-12143).

* docs: changelog and credits for form-data security bump (PR #1118)

* revert: drop settingsCredits entry for form-data bump

* chore(nix): sync npmDepsHash with package-lock.json

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

2026-06-17 19:10:52 +03:00

..

psysonic.nix

feat(cover): unify cover pipeline and stabilize mainstage/now-playing (#870)

2026-05-26 19:35:08 +03:00

upstream-sources.json

fix(deps): bump transitive form-data to 4.0.6 (GHSA-hmw2-7cc7-3qxx) (#1118)

2026-06-17 19:10:52 +03:00