[devrev-agentic-swarm]

DevRev: ISS-387450
Closes ISS-387450 on merge.

Why this change

Scanner-reported vulnerable components are upgraded below. This PR is an audited draft, not proof of production remediation.

follow-redirects

Upgrade dependency to 1.16.1.
Targets 2 scanner finding records (records are not unique CVEs or proof of closure).

What changed

• code/package-lock.json
• code/package.json

How we verified it

• Engineer committed the scoped change.
• Independent QA verified the same commit; auditor approved with no unresolved concerns.

Role reports and verification notes

Engineer report (audited-head evidence):

Passed: npm ci --no-audit --no-fund (setup, Node v22.23.1/npm 10.9.8); npm ls follow-redirects --all resolved 1.16.1 including axios; npm run build; npm run lint; lock manifest/version/integrity checks and local HTTP redirect smoke; git diff --check. Failed/pre-existing: npm test -- --runInBand exits 1 because Jest discovers zero tests (same result verified at base_sha with manifest/lock temporarily stashed; no assertion failed). No verification repair: generating tests or changing Jest policy is not warranted for dependency-only change. Deferred to CI: full repository test suite once tests exist. Targeted local verification; full suite pending CI. No independent scanner rescan claimed.

Qa report (audited-head evidence):

Passed: exact HEAD/parent and complete two-file diff, clean workspace, npm ci, independent registry integrity comparison, exact manifest/lock/installed resolution (including axios), local axios redirect assertion, build, lint and diff checks. Failed/incomplete: npm test -- --runInBand exits 1 solely because zero Jest tests exist; base tree also has zero Jest test files, with no changed source or test configuration. An initial ad-hoc check failed due to an incorrect QA expectation of axios's declared range (^1.15.0 instead of ^1.16.0); corrected independent check passed. Deferred: full repository test suite once tests exist in CI; no scanner rescan claimed. Targeted local verification passed; full suite pending CI.

Auditor report (audited-head evidence):

Audited draft approved for exact follow-redirects 1.16.1 target: HEAD and sole base parent match, only declared manifest/lock changed, QA independent install/registry integrity/resolution/axios redirect/build/lint passed. Jest exits 1 because both base and HEAD have zero Jest tests; explicitly disclosed, not counted as a pass. Exact-head full CI and scanner clearance remain outstanding before promotion; no verification repairs.

Sources and limits

• Snyk finding inventory supplied the remediation targets.
• Oligo: no Oligo runtime/reachability evidence is attached; no reachability claim is made.
• Audited change
• Local checks do not establish full CI, deployment success, other architecture coverage or scanner clearance.

Machine evidence and scanner identifiers

• Audited commit: f5fb50e9ad0b91446505b485e133e1472fb72740
• Fix identity: fix:devrev/airsync-template:npm:follow-redirects
• CVE-2026-111755
• CVE-2026-111756

QA command — exit 0

git rev-parse HEAD HEAD^; git status --short; git diff --name-status 050349c2e3308507cfcb63cf974883565c72a63c HEAD; git diff --check 050349c2e3308507cfcb63cf974883565c72a63c HEAD; git diff 050349c2e3308507cfcb63cf974883565c72a63c HEAD -- code/package.json code/package-lock.json

HEAD f5fb50e9ad0b91446505b485e133e1472fb72740; parent 050349c2e3308507cfcb63cf974883565c72a63c; status clean; only package.json and package-lock.json modified; pinned dependency and lock entry move 1.16.0 to 1.16.1; diff check clean.

QA command — exit 0

find . -name AGENTS.md -o -name README.md | head -40; node --version; npm --version

README.md found; Node v22.23.1; npm 10.9.8.

QA command — exit 0

find . -path './code/node_modules' -prune -o -name AGENTS.md -print; find code/test -maxdepth 3 -type f -print; git status --porcelain=v1

No AGENTS.md; code/test contains main.ts, types.ts, http_client.ts, runner.ts; status clean.

QA command — exit 0

npm ci --no-audit --no-fund (cwd code)

added 747 packages in 4m; only deprecation warnings.

QA command — exit 0

npm ls follow-redirects --all (cwd code)

axios@1.20.0 -> follow-redirects@1.16.1 deduped; root follow-redirects@1.16.1.

QA command — exit 0

npm run build (cwd code)

rimraf ./dist && tsc passed.

QA command — exit 0

npm run lint (cwd code)

eslint . passed.

QA command — exit 1

npm test -- --runInBand (cwd code)

No tests found, exiting with code 1; 71 files checked, 0 matches.

QA command — exit 0

npm view follow-redirects@1.16.1 dist.integrity dist.tarball --json (cwd code)

sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==; https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz; matches lock.

QA command — exit 1

node <<'NODE' [initial inline manifest/lock/axios redirect assertions, cwd code] NODE

QA's assumed axios dependency range ^1.15.0 was incorrect: actual ^1.16.0; corrected check uses semver.satisfies.

QA command — exit 0

node <<'NODE' [inline exact-version manifest/lock single-entry/integrity/installed-version and axios semver/local HTTP redirect assertions, cwd code] NODE

PASS: manifest/lock exact version, single copy, integrity and resolved URL, axios caller local redirect.

QA command — exit 0

git diff --exit-code 050349c2e3308507cfcb63cf974883565c72a63c f5fb50e9ad0b91446505b485e133e1472fb72740 -- code/jest.config.js code/test code/src; git ls-tree -r --name-only 050349c2e3308507cfcb63cf974883565c72a63c code | node -e '[count base Jest filenames]'; git status --porcelain=v1; git rev-parse HEAD HEAD^; git diff --check 050349c2e3308507cfcb63cf974883565c72a63c HEAD

Base has zero Jest test files; no source/test/config modifications; workspace clean; final HEAD and parent unchanged; diff check clean.

• Scanner finding: 01a15c28-09cb-7323-bc36-ba3e53326c8d / project 83d3e4d8-09f9-4bd3-9f87-993b1670fecb
• Scanner finding: 01a15c28-09cb-7327-853e-111aaeb8b4d9 / project 83d3e4d8-09f9-4bd3-9f87-993b1670fecb

Review and rollout

• CODEOWNERS own review, readiness and merge; automation does not merge or deploy.
• Required CI must pass on the exact PR head; local verification is not CI clearance.
• Vulnerability tickets remain open until deployment and scanner verification.