[KrzysztofPajak]

Type: bugfix

Issue

The Scan repository job of the Trivy workflow fails on develop (run 41178316895). The Trivy filesystem gate step reports follow-redirects 1.16.1 in src/Web/Grand.Web/vueapp/package-lock.json as CVE-2026-116689 (HIGH), fixed in 1.16.2.

The package comes in through axios. No commit introduced the failure: the finding arrived with the vulnerability database.

Solution

Move follow-redirects to 1.16.2 in the lockfile. The axios range (^1.16.0) already allows it, so package.json does not change.

Only the three lines of that package's entry change. npm update on npm 10.9 also strips the libc fields of the native optional packages, so that part was left out.

The committed bundles do not change: they contain no follow-redirects code, and a build on 1.16.1 and a build on 1.16.2 produce the same SHA-256 for all four bundle files.

Breaking changes

None.

Testing

1. In src/Web/Grand.Web/vueapp, run npm ci. It installs follow-redirects 1.16.2.
2. Run npm run audit:prod. It reports 0 vulnerabilities.
3. Run npm run build, then git diff --stat --ignore-space-at-eol. No bundle has a content change.
4. Check that the Scan repository job of the Trivy workflow passes on this pull request.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.