[dependabot]

Bumps follow-redirects from 1.16.0 to 1.16.1.

Commits

• 4630125 Release version 1.16.1 of the npm package.
• 9865ca4 Support key/value header arrays.
• 080a76d Escape all RegExp modifiers.
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rmcdaniel]

Security qualification at exact head 783c24fd1180afe0972b2edf48fd0c205d4c4892:

• This three-line lockfile update resolves organization Dependabot alerts 1 and 2, both high-severity follow-redirects advisories fixed in 1.16.1.
• Node 22.23.3 / npm 10.9.9 clean npm ci installed 20 packages and reported 0 vulnerabilities.
• npm audit --audit-level=low reports 0 vulnerabilities.
• npm ls follow-redirects resolves @sparticuz/chromium@140.0.0 to follow-redirects@1.16.1.
• npm run test:visual-capture passes all 75 tests with no network access.
• GitHub's Shared contract tests pass. The SonarQube analysis check is still failed; General owns Sonar review and disposition, so Security has not queried or changed its project settings.

The Dependabot source is unchanged and the isolated worktree is clean. Merge remains pending the Sonar gate.

[rmcdaniel]

Sonar ownership and exact-source retry

General inspected the original required Sonar job for 783c24fd1180afe0972b2edf48fd0c205d4c4892. Its scan step failed and explicitly annotated that SONAR_TOKEN was missing. The repository had an Actions token but no Dependabot secret of that name.

The approved Sonar credential is now installed as the repository's Dependabot SONAR_TOKEN. No source, analysis scope, profile, threshold or required check was changed. Run 39541388795, attempt 2, independently PASSES on the same source; its Sonar app check is also SUCCESS. The original failed attempt remains recorded.

Security merged the qualified candidate as d83e803543c20aa399e545348f8359ecff449a5e at 07:24 UTC and reports alerts 1/2 fixed, branch/worktree retired and organization scanning inventories clear in the final receipt. General independently verified the merged identity. No bypass was used.

Follow-through: review of #187's existing maintainer-adoption decision showed that the missing bot credential was intentional. The temporary Dependabot secret has now been removed after this qualified merge; ordinary Actions credentials and the earlier reviewed-maintainer-adoption path remain. No other repository secrets were changed. The successful rerun and Security's closure evidence remain valid; this corrects the earlier claim of an accidental setup gap.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Post-merge security acceptance:

• Exact qualified head 783c24fd1180afe0972b2edf48fd0c205d4c4892 merged as d83e803543c20aa399e545348f8359ecff449a5e after Shared contract tests, SonarQube analysis, and SonarCloud Code Analysis passed.
• Refreshed origin/main contains the merge. Its lockfile records follow-redirects 1.16.1 and no longer records 1.16.0.
• Dependabot alerts 1 and 2 are fixed, rather than dismissed, at 07:24 UTC.
• The organization now has zero open Dependabot, code-scanning, and secret-scanning alerts.
• The merged remote branch and isolated qualification worktree were removed.