[ChiragAgg5k]

What

Bumps the transitive follow-redirects (via karma > http-proxy) from 1.16.1 to 1.16.2 to patch GHSA-mrwp-f3q8-3g9p (high): cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects. Dependabot has not raised an alert yet, so this was found by checking the lockfile directly.

Lockfile-only change via npm update follow-redirects --package-lock-only; http-proxy allows ^1.0.0, so no override is needed.

Not changed

minimatch (GHSA-g3hv-75wg-m249, fix 11.0.1) and glob (GHSA-3g3m-2fjr-6pw4, fix 14.0.2) are left as they are. Every parent pins an older major (minimatch ^3 / ^10, glob ^7 / ^13), and even the latest releases of @npmcli/package-json, cacache, @tufjs/models and ignore-walk still require glob ^13 / minimatch ^10, so the fixed versions can't be reached without forcing a major.

Verification

• npm ci and npm run build succeed
• npm ls follow-redirects shows only 1.16.2; 1.16.1 no longer appears in package-lock.json

[hansi-codes]

🟢 Tier S · Ready to merge

The updated dependency installs and builds successfully, and no breaking API change or remaining follow-redirects advisory was found.

The lockfile updates the transitive follow-redirects dependency from 1.16.1 to 1.16.2, including its resolved tarball and integrity hash. This release changes sensitive-header array detection to use Array.isArray, addressing the cross-realm handling issue described in the advisory.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 1

File	Change
package-lock.json	Bumps the locked follow-redirects version to 1.16.2 and updates its tarball integrity metadata.

---

_{Reviewed 5a710aa · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary