Skip to content

Bump follow-redirects from 1.15.6 to 1.16.0 in /fixtures/concurrent/time-slicing#326

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/fixtures/concurrent/time-slicing/follow-redirects-1.16.0
Closed

Bump follow-redirects from 1.15.6 to 1.16.0 in /fixtures/concurrent/time-slicing#326
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/fixtures/concurrent/time-slicing/follow-redirects-1.16.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 14, 2026

Copy link
Copy Markdown

Bumps follow-redirects from 1.15.6 to 1.16.0.

Commits
  • 0c23a22 Release version 1.16.0 of the npm package.
  • 844c4d3 Add sensitiveHeaders option.
  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
  • 86dc1f8 Sanitizing input.
  • 21ef28a Release version 1.15.11 of the npm package.
  • 7c88135 Roll back tree shaking.
  • 6e389ba Release version 1.15.10 of the npm package.
  • 5bc496e Shake me up before you go-go.
  • 694d6b4 Bump minimist from 1.2.5 to 1.2.8
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump follow-redirects in /fixtures/concurrent/time-slicing
91c09ea 
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.6 to 1.16.0.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 14, 2026
@karencapiiro

karencapiiro commented Apr 14, 2026

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Details – 243a1088-a105-456d-90d2-268560e765a4

New Issues (249) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL CVE-2026-0905 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Insufficient policy enforcement in the Network in Google Chrome prior to 144.0.7559.59 allowed an attacker who obtained a network log file to poten...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: NdQ9Ii4qW%2F0q0O7WNU2qm%2BzC4G%2FVwvh4FMjQHAr1Iew%3D
Vulnerable Package
2 CRITICAL CVE-2026-0906 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: dE%2FT03QJr4oVTAn5%2BuGgjFvdtMxQXL1Y2sYc7lh7u5Q%3D
Vulnerable Package
3 CRITICAL CVE-2026-0907 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: TPqac%2BPHcofhYKORFmolSj73HsgzImJOhyceAbmZ8FU%3D
Vulnerable Package
4 CRITICAL CVE-2026-1525 Npm-undici-5.20.0
detailsRecommended version: 6.24.0
Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 9JQDFQVbX7JfZ7lv312JuNsjqcbWlIAasfMI4A3Z3Sw%3D
Vulnerable Package
5 CRITICAL CVE-2026-1525 Npm-undici-5.22.1
detailsRecommended version: 6.24.0
Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: kwZg05s26CXL0bMLPHKzmHDxFBUs4myJXAC8uU5zPio%3D
Vulnerable Package
6 CRITICAL CVE-2026-3061 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Out-of-bounds Read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafte...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Wcmmri1CPjy5DKFcC6UQSueS2g84Leh3FYImTD7tWzg%3D
Vulnerable Package
7 CRITICAL CVE-2026-3062 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Out-of-bounds Read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory acce...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: R08Rr0NYlNL0lNN30MWndOHQNCd96orZh7OWPgpUVpM%3D
Vulnerable Package
8 CRITICAL CVE-2026-33896 Npm-node-forge-0.10.0
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 0tuNzf2SkFJY4duQ66XXHX8h0VKWHDVsn4PjIG%2F0o7I%3D
Vulnerable Package
9 CRITICAL CVE-2026-33896 Npm-node-forge-0.6.33
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 19RxmoWReJe%2FmWPqTp%2B8Kr1cTvm%2Bkl6YneUpjoEdySE%3D
Vulnerable Package
10 CRITICAL CVE-2026-33896 Npm-node-forge-1.3.1
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: %2Bgo4Z1QtXPtgiJZ99wvKVPaP79MCpVBP1WCWx%2F%2B4WAo%3D
Vulnerable Package
11 CRITICAL CVE-2026-33896 Npm-node-forge-0.7.6
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: u81sjlklKrYvOvdsHJqlx%2B86QS%2BAjHugO2i0Ae7XrM8%3D
Vulnerable Package
12 CRITICAL CVE-2026-33937 Npm-handlebars-4.5.3
detailsRecommended version: 4.7.9
Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: dYEmsvuZbpxEM6KiCieOjQLTg3TbMcsFvmEnQAlsOeE%3D
Vulnerable Package
13 CRITICAL CVE-2026-33937 Npm-handlebars-4.7.6
detailsRecommended version: 4.7.9
Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: W97Rt23ydAdedUKxilEzbhlwCFtXxSBj1OyVN3ORo1o%3D
Vulnerable Package
14 CRITICAL CVE-2026-33937 Npm-handlebars-4.7.7
detailsRecommended version: 4.7.9
Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: zwycW7bxxnBMjjpZcI10sQHutXezGXh1YAJWk4XBxPo%3D
Vulnerable Package
15 CRITICAL CVE-2026-3545 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox esca...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: %2FPWD%2Fj1v5nMXoeB24O%2Fi%2F%2BT6Se89vNK6epRr4E7FSes%3D
Vulnerable Package
16 CRITICAL CVE-2026-3916 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Out-of-bounds Read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a cr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: rItbjsBl8QJECbuTPeYx1d%2BrWKjJlDX2eDXa9sksNf4%3D
Vulnerable Package
17 CRITICAL CVE-2026-4800 Npm-lodash-4.17.15
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 5w%2BjCaYCBCbQqDcbVREouQEaD4uGosAW1ODofhRFE7w%3D
Vulnerable Package
18 CRITICAL CVE-2026-4800 Npm-lodash-4.17.11
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: fupOeR%2F%2BMN2dpQARjKPx%2BQMTdtVo0ieaRl5KqYltZaQ%3D
Vulnerable Package
19 CRITICAL CVE-2026-4800 Npm-lodash-4.17.20
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Htz5CvlXA7DAVh5ZSFskBNqoa3ZAgnDqnunkDD4K7Mc%3D
Vulnerable Package
20 CRITICAL CVE-2026-4800 Npm-lodash-4.17.21
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: k1jO22VAHKhAjrKLjqNeJnXjgpok2dIG%2FqOOIuZeCwg%3D
Vulnerable Package
21 CRITICAL CVE-2026-4800 Npm-lodash-4.17.4
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: pLvHu8qajsZecxv530dZ7iY%2BVgtZXmD2nW6QThVKG6E%3D
Vulnerable Package
22 CRITICAL CVE-2026-5288 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: %2Bd8KErDWlPCXAmQW3wpOIHXQK4Q9rl0DJkzcWMCW%2Fao%3D
Vulnerable Package
23 CRITICAL Cx0a53ef16-dcb9 Npm-react-devtools-shared-0.0.1
detailsDescription: This package was manually inspected by a security researcher and flagged as malicious ### About Classifying malicious packages is an internal proc...

ID: bkVQcS3BfbGqVMPm7rCIJLHEoWERm8sJ35U%2FHpppsN4%3D
Vulnerable Package
24 HIGH CVE-2023-1220 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Heap-based Buffer Overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to pot...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: AHLw3yhToeo3JfmxF2PkMFSeP9Ny3d5NiCa10nSfZ6M%3D
Vulnerable Package
25 HIGH CVE-2023-1530 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use after free in PDF in Google Chrome versions prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a craf...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: SiSvvuF3dIQvZSriJgGHBSsSPtAWTBw42cD93VOFkr8%3D
Vulnerable Package
26 HIGH CVE-2023-1811 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use after free in Frames in Google Chrome in versions prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific U...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ztweFq0fTLfahqZ7GiEDIJ%2FJkas9Zz1uboC8fMx4gdo%3D
Vulnerable Package
27 HIGH CVE-2023-2135 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use After Free in DevTools in Google Chrome in versions prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific p...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: veA0aAkGW7Bty88Es2bbXbzjXlDgD4ZYeEeEqhan9pg%3D
Vulnerable Package
28 HIGH CVE-2025-13630 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: A628bNXPiAzeROhbCP42L6B8CYcXE8S4OCWmqQwB%2FiM%3D
Vulnerable Package
29 HIGH CVE-2025-13631 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform Privilege Escala...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: kiyIAUwI1%2FmomY%2BG%2FexRpdtZQNsBwBS2iPTJKdx0jWs%3D
Vulnerable Package
30 HIGH CVE-2025-13633 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use After Free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: mc0p8bZx18z45xpd6r06zKPnITSni%2BpF8AKSqRoIQ0w%3D
Vulnerable Package
31 HIGH CVE-2025-13638 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use After Free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a craft...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: UbEoAWOuYlz86TnrhGNtzwgyth%2FG8mDj9QZpNnhzyjw%3D
Vulnerable Package
32 HIGH CVE-2025-13639 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a craf...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: STpLkjBI5LJpD5rxKgHj3X%2Fn2x2drHMlLCGUTmZgD7w%3D
Vulnerable Package
33 HIGH CVE-2025-13720 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploi...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 4BRWUHT5KICH3vW56PXU2w2XKDEDqRMegk%2BDVdcTzRc%3D
Vulnerable Package
34 HIGH CVE-2025-13721 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: aWXBdYQfb1stcol9Ewb3LqSBBXAz06NFkNlOAAVbaTA%3D
Vulnerable Package
35 HIGH CVE-2025-14174 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory acce...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 8E2ifWmKdSxye0GdgBjZQzsmdWqhypWYJWeIkr7meGc%3D
Vulnerable Package
36 HIGH CVE-2025-14765 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HT...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: sUSBr%2FjwqK9lf%2FOSfX1%2BlqIoqYWZDBTihqRGVYmyW%2Fs%3D
Vulnerable Package
37 HIGH CVE-2025-14766 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: AO%2Bfh8IX%2BKPWhzJ7UNhHt5eO3h3uepCR6RcCWH0EHsw%3D
Vulnerable Package
38 HIGH CVE-2026-0628 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malic...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: DkOSmMKiSKIv0P%2FvxoDC%2BovSSukGKMJhVxxD%2FGIHwAs%3D
Vulnerable Package
39 HIGH CVE-2026-0899 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: CacdDnedxEZboEXRvI0FahVx6EBstklav1OUgn4ZouI%3D
Vulnerable Package
40 HIGH CVE-2026-0900 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: YcTU1ef%2BAv%2Br2vkY%2BxFxvccmRVJvWcE044PVyz9eLYc%3D
Vulnerable Package
41 HIGH CVE-2026-0902 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: mJ68wfAVE%2B92WRuH2avyqm%2F6wJoCce1CgQ7OraGZc%2BE%3D
Vulnerable Package

More results are available on the CxOne platform

Fixed Issues (5) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM CVE-2025-13466 Npm-body-parser-1.19.2
MEDIUM CVE-2025-13466 Npm-body-parser-1.19.0
MEDIUM CVE-2025-13466 Npm-body-parser-1.18.2
MEDIUM CVE-2025-13466 Npm-body-parser-1.20.1
MEDIUM CVE-2025-13466 Npm-body-parser-1.20.2

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

@github-actions

github-actions Bot commented Jul 13, 2026

Copy link
Copy Markdown

This pull request has been automatically marked as stale. If this pull request is still relevant, please leave any comment (for example, "bump"), and we'll keep it open. We are sorry that we haven't been able to prioritize reviewing it yet. Your contribution is very much appreciated.

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown

Closing this pull request after a prolonged period of inactivity. If this issue is still present in the latest release, please ask for this pull request to be reopened. Thank you!

@github-actions github-actions Bot closed this Jul 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/fixtures/concurrent/time-slicing/follow-redirects-1.16.0 branch July 20, 2026 04:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code Resolution: Stale

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@karencapiiro