[huyplb]

Why

GHSA-mrwp-f3q8-3g9p (high, published 2026-10-30): follow-redirects 1.16.0 to 1.16.1 drops cross-realm sensitiveHeaders arrays, so custom credentials can follow a redirect. npm audit --audit-level=high in the ESLint job fails on it, which turns that job red on every open PR (#569, #570).

What

Only the lockfile entry changes, to 1.16.2, the first patched release. Its version, tarball URL and integrity hash come from the npm registry. Its dependents' range, ^1.16.0, already allows it, so this is what npm audit fix would do. No override is added, so later patch releases stay open.

The three moderate advisories (glob and minimatch under @fastify/static) are below the audit's high threshold. Their fix is a breaking downgrade, so they're out of scope here.

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only patch bump for a known redirect/credentials advisory; no application code changes.

Overview
Resolves GHSA-mrwp-f3q8-3g9p by pinning the transitive follow-redirects dependency from 1.16.1 to 1.16.2 in package-lock.json only (version, tarball URL, and integrity hash). Existing dependents already declare ^1.16.0, so no package.json or override changes.

This clears npm audit --audit-level=high failures in the ESLint CI job that were blocking open PRs.

^{Reviewed by Cursor Bugbot for commit 44690d4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[huyplb]

Folded into #571: each fix turns a different job red, so they have to land together.