diff --git a/docs/infrastructure/2026-10-21-follow-redirects-patch.md b/docs/infrastructure/2026-10-21-follow-redirects-patch.md
new file mode 100644
index 0000000..b7613dd
--- /dev/null
+++ b/docs/infrastructure/2026-10-21-follow-redirects-patch.md
@@ -0,0 +1,11 @@
+# Bounded follow-redirects security patch
+
+The21October fresh npm audit identifies production-classified transitive `follow-redirects`1.16.0 with high-severity [array-header credential stripping](https://github.com/advisories/GHSA-q3jh-wrc6-jgq8) and [custom sensitive-header escaping](https://github.com/advisories/GHSA-8r9p-f939-6h3c) advisories. Both advisory records identify1.16.1as patched. This is a dependency finding, not evidence that Jobjakt was exploited or that its browser adapter exercises either vector.
+
+`npm update follow-redirects --ignore-scripts --no-audit --no-fund` changes exactly one package. The only tracked dependency diff is that lock entry's version, tarball URL and integrity:1.16.0→1.16.1. Existing package ranges, Axios, frameworks, other dependencies, audit policy and the owner's temporary dev-only braces exception remain unchanged. No override or new dependency is introduced.
+
+Fresh production audit reports0vulnerabilities. The full audit policy passes with only the previously approved dev-only braces-derived high chain accepted through31October; moderate development findings remain recorded. No additional exception is added. Two synthetic loopback contracts verify array-form Authorization/Cookie/Proxy-Authorization stripping and custom credential names containing`^`/`|`, while retaining a public header. Both pass against the installed1.16.1; no real credentials or external target is involved.
+
+Raw pre/post audit records are `.artifacts/phase7/current/p712-final-security/` and `.artifacts/phase7/current/p712-follow-redirects/`. The bounded helper is `.artifacts/phase7/current/p712-redirect-contract.cjs`. Production build and application/browser TypeScript/lint are rerun; final whole-application/browser proof uses the patched dependency set. The active pre-patch browser candidate is interrupted and retained rather than presented as validating the new lock.
+
+This patch does not resolve the independent runner's Python/.NET native crashes, qualify deployed identity, activate Qwen3.5or complete P5-13. Production readiness remains NO-GO independently of the owner's release authorization. No Phase8 implementation.
diff --git a/job-tracker-ui/package-lock.json b/job-tracker-ui/package-lock.json
index ad28912..0d2c423 100644
--- a/job-tracker-ui/package-lock.json
+++ b/job-tracker-ui/package-lock.json
@@ -7729,9 +7729,9 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
-      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
+      "version": "1.16.1",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
+      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
       "funding": [
         {
           "type": "individual",