From 7390a2fcd1687f083ad87c24148af270e7896b44 Mon Sep 17 00:00:00 2001 From: Antonis Lilis Date: Tue, 27 Oct 2026 10:02:20 +0100 Subject: [PATCH] build(deps): Pin follow-redirects to patched 1.16.1+ to resolve credential-leak advisories nx pins follow-redirects to exactly 1.16.0, so a plain lockfile refresh can't move it. Add a resolutions override forcing >= 1.16.1 (resolves to 1.16.2) to clear two credential-exposure advisories: - follow-redirects: 1.16.0 -> 1.16.2 [#707, #708] Transitive dev/CI-tooling dependency (axios + nx); not shipped in @sentry/react-native. Patch-level bump; stays on the 1.16.x line. Co-Authored-By: Claude Opus 4.8 --- package.json | 1 + yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 8b8dcf14d9..d12a491595 100644 --- a/package.json +++ b/package.json @@ -98,6 +98,7 @@ "glob@npm:^10.3.10": "^10.5.0", "glob@npm:^10.4.2": "^10.5.0", "axios": "^1.20.0", + "follow-redirects": "^1.16.1", "fast-xml-parser": "^5.7.0", "form-data": "4.0.6", "qs": "^6.16.0", diff --git a/yarn.lock b/yarn.lock index 8091213358..d4bc26d045 100644 --- a/yarn.lock +++ b/yarn.lock @@ -14683,13 +14683,13 @@ __metadata: languageName: node linkType: hard -"follow-redirects@npm:1.16.0, follow-redirects@npm:^1.16.0": - version: 1.16.0 - resolution: "follow-redirects@npm:1.16.0" +"follow-redirects@npm:^1.16.1": + version: 1.16.2 + resolution: "follow-redirects@npm:1.16.2" peerDependenciesMeta: debug: optional: true - checksum: 10c0/a1e2900163e6f1b4d1ed5c221b607f41decbab65534c63fe7e287e40a5d552a6496e7d9d7d976fa4ba77b4c51c11e5e9f683f10b43011ea11e442ff128d0e181 + checksum: 10c0/ff38c8ceb904e505021057f58d395ea5f2e7c34257032960a76b21df1726395ce753f5678b6ee3b15210a557277c00b2607c67b682ee4dec1f33cb5147e08e90 languageName: node linkType: hard