lgtm,codescanning
* URIs used in the form-data library are now recognized as sinks for `js/request-forgery`.
  Affected packages are
    [form-data](https://www.npmjs.com/package/form-data)