supabase / supabase / 41432526149

87%

push

github

chore(deps): bump follow-redirects to 1.16.2 (#52612)

Bumps the transitive dependency `follow-redirects` from 1.16.1 to 1.16.2
in `pnpm-lock.yaml` to resolve a high-severity advisory reported by
`pnpm audit`.

## Problem

`pnpm audit` flags `follow-redirects` 1.16.1 for
[GHSA-mrwp-f3q8-3g9p](https://github.com/advisories/GHSA-mrwp-f3q8-3g9p)
(CVE-2026-116689): "Cross-realm sensitiveHeaders arrays are discarded
and custom credentials can follow redirects". Affected range is
`>=1.16.0 <=1.16.1`, patched in 1.16.2.

It comes in through `axios`:

- `apps/studio > @stripe/sync-engine > supabase-management-js > axios >
follow-redirects`
- `apps/ui-library > axios > follow-redirects`

## Solution

Ran `scripts/fix-audit-vulnerability.ts follow-redirects`, which moved
the lockfile to 1.16.2 and confirmed with `pnpm audit` that the advisory
is gone without needing a permanent override. No manifest or code
changes.

The `pnpm install` run by the script also rewrote some unrelated
`@smithy/*` lockfile entries (deprecation notes and a `@smithy/core`
resolution for two `@aws-sdk/*` packages). Those hunks were dropped so
the diff only touches the three `follow-redirects` lines. `pnpm install
--frozen-lockfile` passes on the result.

Packages tried first, in the order the script lists them (both reverted
cleanly by the script):

- `@graphql-tools/utils` (GHSA-7mx3-vvmw-hjmv): `still_vulnerable`. The
vulnerable copy is still resolved after the temporary override is
removed, so it needs a parent dependency update.
- `@vue/server-renderer` (GHSA-g2v6-rqmx-r4w6): `still_vulnerable`, same
reason.

## Validation

- `pnpm audit` no longer reports `follow-redirects`; `pnpm why
follow-redirects -r` shows only 1.16.2.
- `pnpm install --frozen-lockfile`: passes.
- `pnpm --filter studio lint`: passes (0 errors).
- `pnpm --filter studio typecheck`: could not finish locally, `tsc` was
killed for running out of memory (exit 137) on both runs. The change is
lockfile-only, so CI ty... (continued)

1979 of 2350 branches covered (84.21%)

Branch coverage included in aggregate %.

2775 of 3134 relevant lines covered (88.54%)

195.58 hits per line