jobtrackingapp/docs/infrastructure/2026-10-21-follow-redirects-patch.md

Bounded follow-redirects security patch

The21October fresh npm audit identifies production-classified transitive follow-redirects1.16.0 with high-severity array-header credential stripping and custom sensitive-header escaping advisories. Both advisory records identify1.16.1as patched. This is a dependency finding, not evidence that Jobjakt was exploited or that its browser adapter exercises either vector.

npm update follow-redirects --ignore-scripts --no-audit --no-fund changes exactly one package. The only tracked dependency diff is that lock entry's version, tarball URL and integrity:1.16.0→1.16.1. Existing package ranges, Axios, frameworks, other dependencies, audit policy and the owner's temporary dev-only braces exception remain unchanged. No override or new dependency is introduced.

Fresh production audit reports0vulnerabilities. The full audit policy passes with only the previously approved dev-only braces-derived high chain accepted through31October; moderate development findings remain recorded. No additional exception is added. Two synthetic loopback contracts verify array-form Authorization/Cookie/Proxy-Authorization stripping and custom credential names containing^/|, while retaining a public header. Both pass against the installed1.16.1; no real credentials or external target is involved.

Raw pre/post audit records are .artifacts/phase7/current/p712-final-security/ and .artifacts/phase7/current/p712-follow-redirects/. The bounded helper is .artifacts/phase7/current/p712-redirect-contract.cjs. Production build and application/browser TypeScript/lint are rerun; final whole-application/browser proof uses the patched dependency set. The active pre-patch browser candidate is interrupted and retained rather than presented as validating the new lock.

This patch does not resolve the independent runner's Python/.NET native crashes, qualify deployed identity, activate Qwen3.5or complete P5-13. Production readiness remains NO-GO independently of the owner's release authorization. No Phase8 implementation.