[dependabot]

Bumps follow-redirects from 1.16.0 to 1.16.1.

Commits

• 4630125 Release version 1.16.1 of the npm package.
• 9865ca4 Support key/value header arrays.
• 080a76d Escape all RegExp modifiers.
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rmcdaniel]

Reviewed the exact dependency patch for alerts #112 and #113. Only follow-redirects changes from 1.16.0 to 1.16.1, including its official tarball integrity. Actual clean locked installation and npm audit report zero vulnerabilities. All six Node controls and the production Vite build pass; application/Composer/SDK references are unchanged.

The initial Sonar job explicitly reports that SONAR_TOKEN is unavailable. GitHub withholds Actions secrets from Dependabot-triggered workflows. This patch changes only the dependency lock and introduces no analyzed application source. The normal main-branch analysis retains its credentials. No credential is added to Dependabot, no quality rule is relaxed and the unavailable PR analysis is not called a pass.

The effective organization rules also require the actual Sonar app result. A reviewed maintainer adoption commit changes no tree content and triggers a fresh, trusted analysis under GitHub's regular credentials. The dependency PR still contains exactly the same three-line lock update. Every required check runs normally on the new commit; no secret is supplied to Dependabot and no required result is bypassed.

A separate local experiment with a narrower actor condition was rejected by the shared trust validator and was not committed or published. Skipping the bot analysis would not satisfy the required Sonar app result, so it is not used as a workaround.

Normal required application/microservice qualification, polyglot smoke and Compose smoke remain enforced. Existing SDK runtime cohorts are unchanged. The dependency is also present in the development image, so the merged source must receive a new normal image publication and installed startup verification before downstream delivery is called complete.

Protected merge is complete: 0b2ac94 at 22:35:00 UTC has exactly the reviewed cb54e58 tree, a8763e518b8df9882c659302f788c204c756feeb. Every required check passes, including the actual SonarCloud app and aggregate. GitHub reports alert 112 fixed at 22:35:05 and alert 113 fixed at 22:35:06; the current open-alert inventory is empty. No dismissal was used. The remote dependency branch is absent.

Published-image delivery is now verified. Protected workflow 39509176802 passes native amd64 and arm64 builds, manifest assembly, both actual installed development-container qualification jobs, and main-channel publication. Its qualification runs the committed post-create procedure, application HTTP readiness/home checks, strict Composer lock validation, offline Cargo checks and the tool checks, with provenance and SBOM attestations. Anonymous registry inspection independently confirms that GHCR's main and immutable sha-0b2ac9455c7d95a437ab19e0f13e95426792df67-run-39509176802-1 tags have identical platform and attestation digests. The amd64 image is sha256:1f5636564225dcfb814a9a64811dc76d6b074529a90e05f7121dcde32e6d21c7; arm64 is sha256:362fd6edf2fca231c8445e09468973026b8da40318776f4b747f091be027e9a2. Local verification dependencies and registry scratch are retired. This completes this dependency-security update's source, alert and development-image follow-through.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud