[saadahmed95]

Pull Request

Why

Build chain is a required check, and it now fails on every pull request here. GHSA-mrwp-f3q8-3g9p (high, published 2026-10-30 22:59 UTC) covers follow-redirects 1.16.0 to 1.16.1, and 1.16.2 fixes it. The package is dev-only, through mongodb-memory-server-core, whose ^1.16.0 range already admits the fix.

What Changed

• package-lock.json: the single follow-redirects entry moves to 1.16.2, by its version, resolved and integrity lines. No package.json changes.

Alternatives Considered

• npm update follow-redirects --package-lock-only as it stands. Run with npm 10, it also strips four libc lines from unrelated optional packages, so I edited the three lines by hand.
• npm audit fix. It can also move packages behind the moderate and low findings, which this PR isn't about.
• Recording an acceptance in .github/audit-acknowledgements.json. A fix exists and costs one lockfile entry.
• Bumping mongodb-memory-server. Its range already admits 1.16.2.

ADRs & Architecture

None.

Testing

• Audit: node scripts/check-audit.mjs went from 1 finding to "clean at high and above (27 moderate, 7 low), 0 acceptance(s)".
• Lockfile: the diff is those three lines, the integrity matches npm view follow-redirects@1.16.2 dist.integrity, and npm ci --ignore-scripts --dry-run accepts it.
• Runtime: mongodb-memory-server-core is this package's only consumer here, and CI's Verify boots mongod through it.
• Changelog: bash scripts/check-changelog.sh origin/main reports no shipped source changed.

Code Quality Checklist

• Lint: N/A, no code changed
• Types: N/A, no code changed
• Tests: N/A, a lockfile entry; CI runs the suite against it
• No Secrets: No API keys, tokens, or credentials committed
• Formatting: N/A, no code changed
• Documentation: N/A
• Layer Adherence: N/A, outside src/
• No console.log: N/A, no code changed
• Changelog: no shipped source changed

Related Issues

None. This unblocks #300, whose Build chain fails on this advisory.

🤖 Generated with Claude Code

[lore-agent]

Lore is reviewing this PR — 2643c806-cf1d-4fd2-98c7-0dd5bfc1b996.

Submit a review that requests changes to have Lore push a fix for it. Comment @lore review to re-run the review.

[lore-agent]

Not merging yet: Waiting for CI. Lore updates this comment when the reason changes.

[github-actions]

🔍 Lore Spec Impact

Examined 1 changed file(s): 0 had graph data (no coupling found), 1 had none — no ingested test run covers them, so this check cannot speak for them.

_{Deterministic · graph @ 1a9af90 (projected 2026-10-29) · 1 file(s) skipped: changed since the graph last saw them, so their line numbers no longer line up · no tests run by this check}

[lore-agent]

Lore review — Approved

Clean lockfile bump of transitive devDependency follow-redirects from 1.16.1 to 1.16.2 for GHSA-mrwp-f3q8-3g9p.

Must fix (0) · Consider (0) · Nits (0)

Reviewed by gemini-4-argon

Submit a review that requests changes to have Lore push a fix for it. Comment @lore review to re-run the review.

Posted by floor, visit 5d618863-94ff-4a48-a6ea-4674fea9a91b.