chore(dep): upgrade cypress/request to 3.0.9 to address form-data vulnerabilities (#32096)

* chore(deps): upgrade @cypress/request

* changelog

Author: cacieprins

cli/CHANGELOG.md

@@ -9,6 +9,10 @@ _Released 7/30/2025 (PENDING)_
 - Fixed an issue where TypeScript ESM projects using `.js` and `.mjs` extensions where not resolving correctly within `@cypress/webpack-batteries-included-preprocessor`. Addressed in [#31994](https://github.com/cypress-io/cypress/pull/31994). Fixes [#26827](https://github.com/cypress-io/cypress/issues/26827) and [#28805](https://github.com/cypress-io/cypress/issues/28805).
 - Fixed an issue in `@cypress/angular` where component instance fields were not reference safe and were being overwritten. Fixes [#31238](https://github.com/cypress-io/cypress/issues/31238) and [#31983](https://github.com/cypress-io/cypress/issues/31983). Fixed in [#31993](https://github.com/cypress-io/cypress/pull/31993).
 
+**Dependency Updates:**
+
+- Upgraded `@cypress/request` to 3.0.9, to resolve [CVE-2025-7783](https://github.com/advisories/GHSA-fjxv-7rqg-78g4) in `form-data`. Addresses [#32091](https://github.com/cypress-io/cypress/issues/32091).
+
 ## 14.5.2
 
 _Released 7/15/2025_

cli/package.json

@@ -20,7 +20,7 @@
     "unit": "cross-env BLUEBIRD_DEBUG=1 NODE_ENV=test mocha --reporter mocha-multi-reporters --reporter-options configFile=../mocha-reporter-config.json"
   },
   "dependencies": {
-    "@cypress/request": "^3.0.8",
+    "@cypress/request": "^3.0.9",
     "@cypress/xvfb": "^1.2.4",
     "@types/sinonjs__fake-timers": "8.1.1",
     "@types/sizzle": "^2.3.2",

package.json

@@ -75,7 +75,7 @@
     "@aws-sdk/client-s3": "3.485.0",
     "@aws-sdk/credential-providers": "3.53.0",
     "@babel/eslint-parser": "7.25.1",
-    "@cypress/request": "^3.0.8",
+    "@cypress/request": "^3.0.9",
     "@cypress/request-promise": "^5.0.0",
     "@electron/fuses": "1.8.0",
     "@electron/notarize": "^2.5.0",

packages/https-proxy/package.json

@@ -24,7 +24,7 @@
   },
   "devDependencies": {
     "@cypress/debugging-proxy": "2.0.1",
-    "@cypress/request": "^3.0.8",
+    "@cypress/request": "^3.0.9",
     "@cypress/request-promise": "^5.0.0",
     "@packages/network": "0.0.0-development",
     "@packages/ts": "0.0.0-development",

packages/network/package.json

@@ -28,7 +28,7 @@
   },
   "devDependencies": {
     "@cypress/debugging-proxy": "2.0.1",
-    "@cypress/request": "^3.0.8",
+    "@cypress/request": "^3.0.9",
     "@cypress/request-promise": "^5.0.0",
     "@packages/https-proxy": "0.0.0-development",
     "@packages/socket": "0.0.0-development",

packages/proxy/package.json

@@ -31,7 +31,7 @@
     "utf8-stream": "0.0.0"
   },
   "devDependencies": {
-    "@cypress/request": "^3.0.8",
+    "@cypress/request": "^3.0.9",
     "@cypress/request-promise": "^5.0.0",
     "@cypress/sinon-chai": "2.9.1",
     "@packages/errors": "0.0.0-development",

packages/server/package.json

@@ -26,7 +26,7 @@
     "@babel/parser": "7.25.3",
     "@cypress/commit-info": "2.2.0",
     "@cypress/get-windows-proxy": "1.6.2",
-    "@cypress/request": "^3.0.8",
+    "@cypress/request": "^3.0.9",
     "@cypress/request-promise": "^5.0.0",
     "@cypress/vite-dev-server": "0.0.0-development",
     "@cypress/webpack-batteries-included-preprocessor": "0.0.0-development",

system-tests/package.json

@@ -23,7 +23,7 @@
     "@babel/preset-env": "7.25.3",
     "@cypress/commit-info": "2.2.0",
     "@cypress/debugging-proxy": "2.0.1",
-    "@cypress/request": "^3.0.8",
+    "@cypress/request": "^3.0.9",
     "@cypress/request-promise": "^5.0.0",
     "@cypress/sinon-chai": "2.9.1",
     "@cypress/webpack-preprocessor": "0.0.0-development",

yarn.lock

@@ -2784,18 +2784,18 @@
     stealthy-require "^1.1.1"
     tough-cookie "^4.1.3"
 
-"@cypress/request@^3.0.8":
-  version "3.0.8"
-  resolved "https://registry.yarnpkg.com/@cypress/request/-/request-3.0.8.tgz#992f1f42ba03ebb14fa5d97290abe9d015ed0815"
-  integrity sha512-h0NFgh1mJmm1nr4jCwkGHwKneVYKghUyWe6TMNrk0B9zsjAJxpg8C4/+BAcmLgCPa1vj1V8rNUaILl+zYRUWBQ==
+"@cypress/request@^3.0.9":
+  version "3.0.9"
+  resolved "https://registry.yarnpkg.com/@cypress/request/-/request-3.0.9.tgz#8ed6e08fea0c62998b5552301023af7268f11625"
+  integrity sha512-I3l7FdGRXluAS44/0NguwWlO83J18p0vlr2FYHrJkWdNYhgVoiYo61IXPqaOsL+vNxU1ZqMACzItGK3/KKDsdw==
   dependencies:
     aws-sign2 "~0.7.0"
     aws4 "^1.8.0"
     caseless "~0.12.0"
     combined-stream "~1.0.6"
     extend "~3.0.2"
     forever-agent "~0.6.1"
-    form-data "~4.0.0"
+    form-data "~4.0.4"
     http-signature "~1.4.0"
     is-typedarray "~1.0.0"
     isstream "~0.1.2"
@@ -17100,7 +17100,7 @@ form-data@^3.0.0:
     hasown "^2.0.2"
     mime-types "^2.1.35"
 
-form-data@^4.0.0, form-data@^4.0.1, form-data@~4.0.0:
+form-data@^4.0.0, form-data@^4.0.1, form-data@~4.0.4:
   version "4.0.4"
   resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.4.tgz#784cdcce0669a9d68e94d11ac4eea98088edd2c4"
   integrity sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==