From c7703af507fb9d64053e0b5b9ae7cc13a39eaf6b Mon Sep 17 00:00:00 2001 From: Eras256 <219895655+Eras256@users.noreply.github.com> Date: Sat, 31 Oct 2026 20:02:04 -0600 Subject: [PATCH] fix(deps): bump follow-redirects to 1.16.2 (GHSA-mrwp-f3q8-3g9p) axios pulls in follow-redirects via a loose ^1.16.0 range; the lockfiles in packages/sdk, packages/cli and packages/mcp had it pinned at 1.16.1, which is inside the vulnerable range (>=1.16.0, <=1.16.1). Lockfile-only bump to the patched 1.16.2 - no package.json changes, no other dependency touched. This was blocking the Security Gate on #230 and #231. Co-Authored-By: Claude Sonnet 5 --- packages/cli/package-lock.json | 4 +++- packages/mcp/package-lock.json | 6 +++--- packages/sdk/package-lock.json | 6 +++--- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/packages/cli/package-lock.json b/packages/cli/package-lock.json index 8a46c5a..caef706 100644 --- a/packages/cli/package-lock.json +++ b/packages/cli/package-lock.json @@ -764,7 +764,9 @@ } }, "node_modules/follow-redirects": { - "version": "1.16.1", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", diff --git a/packages/mcp/package-lock.json b/packages/mcp/package-lock.json index 008b463..2198c21 100644 --- a/packages/mcp/package-lock.json +++ b/packages/mcp/package-lock.json @@ -1447,9 +1447,9 @@ } }, "node_modules/follow-redirects": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", - "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", diff --git a/packages/sdk/package-lock.json b/packages/sdk/package-lock.json index d42e653..8be138f 100644 --- a/packages/sdk/package-lock.json +++ b/packages/sdk/package-lock.json @@ -3149,9 +3149,9 @@ } }, "node_modules/follow-redirects": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", - "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual",