[naor-gal]

Summary

Bumps the transitive follow-redirects (via axios) from 1.16.0 to 1.16.1 in package-lock.json. That clears the two high-severity advisories published Oct 20 that fail npm audit --omit=dev --audit-level=high:

• GHSA-q3jh-wrc6-jgq8: array-form headers bypass cross-origin credential stripping.
• GHSA-8r9p-f939-6h3c: sensitiveHeaders regex escaping can expose credential headers.

Both affect >=1.16.0 <1.16.1. The audit currently fails on main and on every open PR (#347 among them).

Change

Lockfile only, 3 lines: version, resolved and integrity of node_modules/follow-redirects.

• No package.json change: axios declares ^1.16.0.
• No other package moved.
• 1.16.1's metadata (engines, peers, no dependencies) is identical to 1.16.0's.
• Published 2026-10-01, past the repo's 14-day min-release-age.
• Integrity taken from registry.npmjs.org.

Dependency change: please review the lockfile diff.

Testing

• npm ci installs cleanly from the lockfile, and node_modules/follow-redirects is 1.16.1.
• The audit job on this PR is the check (the local audit endpoint returned a 400).

🤖 Generated with Claude Code

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.56-pr.349.170ad04

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.56-pr.349.170ad04"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.56-pr.349.170ad04"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.56-pr.349.170ad04
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}