[DysektAI]

Advisory chain

Pins the Axios transitive follow-redirects dependency to exactly 1.16.1, addressing GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c without an unrelated dependency refresh.

Verification

• Regression tests reproduce cross-origin credential leakage with array-form headers and sensitive header names containing regex metacharacters on 1.16.0; both pass on 1.16.1.
• Published tarball integrity, publisher metadata, lifecycle-script changes and upstream tag contents were vetted.
• Initial advisory-fix local CodeRabbit review: zero findings. The later hoisting finding was fixed in e38b895 and its thread resolved.
• All 13 branch tests passed with a real nested dependency layout and after a clean locked install; all current-head GitHub checks are green.
• The tests resolve the actual follow-redirects package from Axios rather than relying on root-level hoisting or introducing a duplicate dev-only package.

Integration

PR #38 already includes this commit together with the separate ip-address advisory fix. Its combined production audit has zero advisories. The base lockfile still contains the other vulnerable transitive, so do not treat this standalone branch as a complete production dependency remediation. A fresh standalone production audit still reports one moderate ip-address vulnerability.

PARKED for the coordinated merge: the current head e38b895 is contained in #38 at 464835d, where the production audit is clean. Once #38 passes its outstanding runtime/proxy/token and restart-state gate, preserve history with a merge commit so this advisory PR can merge indirectly without a partially patched default-branch intermediate.

---

Summary by cubic

Pins follow-redirects to 1.16.1 via an override, closing two credential-leak advisories (GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c) without a broader dependency refresh.

Bug Fixes

• Adds regression tests reproducing both advisories; they resolve follow-redirects from the Axios installation so they exercise the real dependency even when it is nested rather than hoisted.
• This branch only addresses follow-redirects; the base lockfile still has other vulnerable transitives, so it is not a complete dependency remediation on its own.

^{Written for commit e38b895. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 8cfbf519-9077-4ddf-b826-46ee34ad125d

📥 Commits

Reviewing files that changed from the base of the PR and between 23ca4c9 and e38b895.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 2

• package.json
• test/redirect-security.test.js

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}