From aa8458f811222bf175d5bf5d9d9d7fe591eda914 Mon Sep 17 00:00:00 2001 From: Nathan Broadbent Date: Sun, 1 Nov 2026 16:30:27 +1300 Subject: [PATCH] fix(deps): follow-redirects 1.16.2 in the web lockfile GHSA-mrwp-f3q8-3g9p (high): follow-redirects 1.16.0 and 1.16.1 could send custom credentials across a redirect. It comes in through axios, whose browser build leaves out the Node HTTP adapter that uses it, so the SPA never ran it; the nightly bun audit fails on the lockfile entry. --- web/bun.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/bun.lock b/web/bun.lock index 5302689f..e844fe54 100644 --- a/web/bun.lock +++ b/web/bun.lock @@ -807,7 +807,7 @@ "flatted": ["flatted@3.4.4", "", {}, "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q=="], - "follow-redirects": ["follow-redirects@1.16.1", "", { "peerDependencies": { "debug": "*" }, "optionalPeers": ["debug"] }, "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg=="], + "follow-redirects": ["follow-redirects@1.16.2", "", { "peerDependencies": { "debug": "*" }, "optionalPeers": ["debug"] }, "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow=="], "form-data": ["form-data@4.0.6", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.4", "mime-types": "^2.1.35" } }, "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ=="],