[tomasr78]

Problem

The build job runs npm audit --omit=dev --audit-level=high, and it has failed on main since 2026-11-07: https://github.com/ConvertAPI/convertapi-library-node/actions/runs/42359841164 (push of a402bd7; the three test jobs passed, only "Audit the runtime dependencies" failed).

axios requires follow-redirects ^1.16.0, and package-lock.json resolves it to 1.16.1, which has the high-severity advisory GHSA-mrwp-f3q8-3g9p (affects 1.16.0 - 1.16.1, fixed in 1.16.2). publish.yml runs the same audit, so no release can go out until this is fixed. It is also the only failing check on #123 and fails #124.

Change

npm update follow-redirects --ignore-scripts (Node v24.20.0, npm 11.19.0) moves the lockfile entry from 1.16.1 to 1.16.3, the latest release. The diff is that entry's version, resolved and integrity, nothing else; package.json is unchanged.

package-lock.json is not part of the npm package, and consumers resolve follow-redirects themselves (axios asks for ^1.16.0, so a fresh install gets 1.16.3), so there is no CHANGELOG entry.

Verification

After npm ci --ignore-scripts on main (a402bd7):

$ npm audit --omit=dev --audit-level=high        # main: exit code 1
# npm audit report

follow-redirects  1.16.0 - 1.16.1
Severity: high
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects - https://github.com/advisories/GHSA-mrwp-f3q8-3g9p
fix available via `npm audit fix`
node_modules/follow-redirects

1 high severity vulnerability

To address all issues, run:
  npm audit fix

After npm ci --ignore-scripts on this branch:

$ npm audit --omit=dev --audit-level=high        # this branch: exit code 0
found 0 vulnerabilities

• npm run build passes.
• npm test (lint, then the tests against staging with CONVERT_API_BASE_URI=https://stag-v2.convertapi.com/): 16 passing.
• npm audit signatures: all 696 packages have verified registry signatures.
• 1.16.3 was published on 2026-11-08. Its index.js, debug.js, http.js and https.js are identical to the v1.16.3 tag of https://github.com/follow-redirects/follow-redirects. From 1.16.1 to 1.16.3, index.js changes in two places: Array.isArray for sensitiveHeaders (the advisory fix, 1.16.2) and braces escaped in escapeRegex (1.16.3), see follow-redirects/follow-redirects@v1.16.1...v1.16.3

After merging

• PDF thumbnail example: keep the thumbnail inside 300x300 #123 must be brought up to date with gh pr update-branch 123 --repo ConvertAPI/convertapi-library-node. Re-running its old run would reuse the old merge commit, which still has 1.16.1.
• deps: bump the npm-minor-and-patch group across 1 directory with 2 updates #124 (Dependabot) needs a new run too. Its branch merges cleanly with this one; if Dependabot has not rebased it, comment @dependabot rebase on it.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.