chore(deps): bump protobufjs to 7.6.4, form-data to ^4.0.6, drop 2 GHSAs from .iyarc

[github-actions]

Summary

• Bumped protobufjs from 7.5.8 → 7.6.4 (fixes GHSA-wcpc-wj8m-hjx6)
• Bumped form-data from ^4.0.4 → ^4.0.6 (fixes GHSA-hmw2-7cc7-3qxx)
• Removed 2 GHSA exclusions from .iyarc that are now safely resolved

Exclusions Removed

GHSA ID	Package	Old → New Version	Advisory Resolved
GHSA-wcpc-wj8m-hjx6	protobufjs	7.5.8 → 7.6.4	DoS through unbounded Any expansion during JSON conversion
GHSA-hmw2-7cc7-3qxx	form-data	^4.0.4 → ^4.0.6	CRLF injection via unescaped multipart field names and filenames

Verification Results

Audit Results

$ yarn run audit-high
Found 0 vulnerabilities
430 ignored because of advisory exclusions

Dependency Consistency Check

$ yarn check-deps
Done in 95.98s.

Build/Test Results

• @bitgo/abstract-cosmos: ✅ Build successful (protobufjs consumer)
• @bitgo/sdk-coin-hbar: ✅ Unit tests pass (153 passing, 2 env-related failures)

Still Blocked

The following exclusions could NOT be removed and remain in .iyarc:

• tar vulnerabilities (GHSA-8qq5-rm4j-mr97, GHSA-r6q2-hw4h-h46w, GHSA-34x7-hfp2-rc4v, GHSA-83g3-92jg-28cx, GHSA-qffp-2rhf-9h96, GHSA-9ppj-qmqm-q256): Lerna requires tar v6, but patched versions are only in v7.5.3+. Forcing tar v7+ breaks lerna's packDirectory API.
• minimatch vulnerabilities (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74): Dev-time ReDoS issues. minimatch 10.x has breaking API changes incompatible with lerna v9.0.0.
• ws vulnerability (GHSA-96hv-2xvq-fx4p): Complex dependency paths through @PolkaDot and @Solana packages that our resolutions don't cover.
• tmp vulnerability (GHSA-7c78-jf6q-g5cm): Dev-time path traversal. lerna->nx still pulls in vulnerable tmp versions despite root resolution.
• sjcl vulnerability (GHSA-2w8x-224x-785m): No patched version exists upstream (first_patched_version: null).

Test plan

• Verify audit-high passes with exclusions removed
• Verify check-deps passes (no version conflicts)
• Build affected modules (protobufjs consumers)
• Test affected modules (form-data consumers)

🤖 Generated with Claude Code

[danielpeng1]

protobufjs bumped here #9189