[ksvirkou-hubspot]

Why

`npm audit` reported 11 vulnerabilities (1 low, 2 moderate, 8 high). They are fixed here so the repo and its build tooling stay clean, and so consumers of the SDK get a patched `form-data`.

What

• `npm audit fix` updates transitive dependencies (`flatted`, `glob`, `js-yaml`, `picomatch`, `ajv`, `diff`, `brace-expansion`, `@humanfs/node`).
• `form-data` is raised from `^4.0.4` to `^4.0.6`. It is the only affected runtime dependency (CRLF injection in multipart field names and filenames). The lockfile is not published, so the new minimum in `package.json` is what guarantees consumers a fixed version.
• `overrides` pins `minimatch` to `^3.1.5` for `replace`. `replace@1.2.2` is its latest release and requires exactly `minimatch@3.0.5`, which has ReDoS issues, so `audit fix` cannot resolve it. `npm audit fix --force` would instead downgrade to `replace@0.2.2`, a breaking change. `replace` is only used by the `version:set` build script and is not shipped in the package.
• `package-lock.json` is regenerated and in sync with `package.json` (`npm ci` passes).

Verification

• `npm audit`: 0 vulnerabilities
• `tsc`, `npm run lint` and `npm test` (86 specs, 0 failures) pass

🤖 Generated with Claude Code