Symptom

Dependabot / Kraken nightly scan flagged an open CVE (GHSA-r4q5-vmmm-2653) against follow-redirects <= 1.15.11 in kotlin-js-store/yarn.lock.

Root cause

follow-redirects 1.15.9 was pinned in the yarn lockfile as a transitive dependency of http-proxy (a webpack/Karma build-tool dependency). Version 1.15.9 falls within the vulnerable range; 1.16.0 is the first patched release.

Fix

Manually updated follow-redirects from 1.15.9 → 1.16.0 in kotlin-js-store/yarn.lock, substituting the resolved URL, SHA1, and integrity hash sourced from the npm registry. The wasm lockfile (kotlin-js-store/wasm/yarn.lock) does not reference follow-redirects and needed no change.

Prevention

• The Kraken nightly dep-CVE scan catches these automatically and files issues for Blue.
• For npm transitive deps in kotlin-js-store/, bump manually by looking up the patched version’s tarball shasum and integrity on registry.npmjs.org/<pkg>/<version>.
• This dependency is build/toolchain only (not on the shipped JVM/WASM runtime classpath), so risk is low but the bump is still correct hygiene.