[Doezer]

Requested by Vincent · project thread

Summary

• sca-scan now fails on every PR: GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c (both high) affect follow-redirects@1.16.0, reached through axios.
• Adds a follow-redirects: ^1.16.1 override (lockfile resolves 1.16.1) and documents it in docs/DEPENDENCIES.md.

Test plan

• npm run check:overrides passes
• node scripts/audit-prod.mjs reports no uncovered high advisories
• CI green

No client/src/** changes.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T22:55:56.056084Z	ab1dd8b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 07ff9e00-86d8-464a-bdc3-598251cd1bcc

📥 Commits

Reviewing files that changed from the base of the PR and between d037c8c and 0a00c80.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 2

• docs/DEPENDENCIES.md
• package.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Pinning follow-redirects to 1.16.1 changes axios redirect handling; a regression could mishandle cross-origin credentials or disrupt redirected requests.

Pins follow-redirects to ^1.16.1 via an override to patch two high advisories (GHSA-q3jh-wrc6-jgq8, GHSA-8r9p-f939-6h3c) affecting follow-redirects@1.16.0 reached through axios, and documents it in docs/DEPENDENCIES.md. The docs' incorrect axios range for follow-redirects has been resolved. No open issues found.

✅ 1 closed

✅ Quality: Docs cite wrong axios range for follow-redirects (^1.15.x vs ^1.16.0)

📄 docs/DEPENDENCIES.md:28 📄 package-lock.json
The new DEPENDENCIES.md entry says axios declares follow-redirects: ^1.15.x. The lockfile shows axios 1.20.0 actually declares "follow-redirects": "^1.16.0". The reasoning still holds, since ^1.16.0 also allows the vulnerable 1.16.0. But the stated range is wrong and could mislead anyone checking later whether the override can be removed. Update the text to ^1.16.0.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[Doezer]

wshm · Automated triage by AI

📊 Automated PR Analysis

🐛 Type	bug-fix
🟢 Risk	low

Summary

This PR adds a package.json override pinning follow-redirects to ^1.16.1 to patch two high-severity security advisories (GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c) that affect the transitive dependency pulled in via axios@^1.16.0. It updates the lockfile accordingly and documents the override and its rationale in docs/DEPENDENCIES.md.

Review Checklist

• Tests present
• Breaking change
• Docs updated

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!