Skip to content

Commit 60b990d

Browse files
antonisclaude
andauthored
build(deps): Pin follow-redirects to patched 1.16.1+ to resolve credential-leak advisories (#6949)
nx pins follow-redirects to exactly 1.16.0, so a plain lockfile refresh can't move it. Add a resolutions override forcing >= 1.16.1 (resolves to 1.16.2) to clear two credential-exposure advisories: - follow-redirects: 1.16.0 -> 1.16.2 [#707, #708] Transitive dev/CI-tooling dependency (axios + nx); not shipped in @sentry/react-native. Patch-level bump; stays on the 1.16.x line. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent f78b6fd commit 60b990d

2 files changed

Lines changed: 5 additions & 4 deletions

File tree

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@
9898
"glob@npm:^10.3.10": "^10.5.0",
9999
"glob@npm:^10.4.2": "^10.5.0",
100100
"axios": "^1.20.0",
101+
"follow-redirects": "^1.16.1",
101102
"fast-xml-parser": "^5.7.0",
102103
"form-data": "4.0.6",
103104
"qs": "^6.16.0",

‎yarn.lock‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14690,13 +14690,13 @@ __metadata:
1469014690
languageName: node
1469114691
linkType: hard
1469214692

14693-
"follow-redirects@npm:1.16.0, follow-redirects@npm:^1.16.0":
14694-
version: 1.16.0
14695-
resolution: "follow-redirects@npm:1.16.0"
14693+
"follow-redirects@npm:^1.16.1":
14694+
version: 1.16.2
14695+
resolution: "follow-redirects@npm:1.16.2"
1469614696
peerDependenciesMeta:
1469714697
debug:
1469814698
optional: true
14699-
checksum: 10c0/a1e2900163e6f1b4d1ed5c221b607f41decbab65534c63fe7e287e40a5d552a6496e7d9d7d976fa4ba77b4c51c11e5e9f683f10b43011ea11e442ff128d0e181
14699+
checksum: 10c0/ff38c8ceb904e505021057f58d395ea5f2e7c34257032960a76b21df1726395ce753f5678b6ee3b15210a557277c00b2607c67b682ee4dec1f33cb5147e08e90
1470014700
languageName: node
1470114701
linkType: hard
1470214702

0 commit comments

Comments
 (0)