[devtools-agent]

Description of the change

Resolves Linear SDK-797: clears every open Dependabot alert on this repo and makes future security fixes arrive as a single grouped PR.

Lockfile refresh (package-lock.json only, package.json untouched):

• follow-redirects 1.16.0 → 1.16.2 (runtime, via axios@1.20.0's ^1.16.0). Clears Dependabot alerts #105 (GHSA-8r9p-f939-6h3c) and #106 (GHSA-q3jh-wrc6-jgq8), both fixed in 1.16.1. 1.16.2 is the latest and includes a tidier version of the same fix.
• serialize-javascript 7.1.2 → 7.1.4 (dev-only, via mocha, inside the existing overrides range ^7.0.5). Clears GHSA-m5mm-p8h7-m29v (low), which npm audit reports but Dependabot hasn't raised yet. Same engines (node >=20) as before.

New .github/dependabot.yml: the repo had no Dependabot config, so security fixes came as one PR per package (e.g. #36–#40). The new npm entry sets a npm-security group with applies-to: security-updates and patterns: ["*"], so each run opens one grouped security PR. open-pull-requests-limit: 0 turns off routine version-update PRs. That limit doesn't apply to security updates.

Real exposure was low: the CLI only passes headers as plain objects (src/common/rollbar-api.js, src/sourcemaps/signed-url-uploader.js) and never sets sensitiveHeaders. The published package also ships without the lockfile. This is mainly about the repo's own CI and dev installs.

This supersedes Dependabot PR #45 (follow-redirects → 1.16.1), which can be closed once this merges.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Maintenance
• New release

Related issues

• SDK-797
• Supersedes Bump follow-redirects from 1.16.0 to 1.16.1 #45

How it was validated

• npm ci on Node 20 / npm 9: npm ls shows follow-redirects@1.16.2 and serialize-javascript@7.1.4, and npm audit reports 0 vulnerabilities
• npm run lint: clean
• npm test: 69 passing, 1 pending (the existing it.skip in test/sourcemaps/command.test.js)
• dependabot.yml parses as valid YAML and only uses documented keys (groups.*.applies-to, open-pull-requests-limit)

Checklists

Development

• Lint rules pass locally
• The code changed/added as part of this pull request has been covered with tests (dependency/config only)
• All tests related to the changed code pass in development

Code review

• This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached
• "Ready for review" label attached to the PR and reviewers assigned
• Issue from task tracker has a link to this pull request
• Changes have been reviewed by at least one other engineer

🤖 Generated with Claude Code

[linear-code]

CR-699

[devtools-agent]

AI Agent Review LGTM (openai, openai-astra)

LGTM. No blocking findings were found.

Review: SDK-797 dependency bump + Dependabot config

LGTM. No defects found in the two changed files.

package-lock.json

• follow-redirects moves to 1.16.2 (package-lock.json:1128-1130). This still satisfies axios@1.20.0's ^1.16.0 range (package-lock.json:469), and axios is still pinned to exactly 1.20.0 in package.json:14. The installed copy matches: node_modules/follow-redirects/package.json:3.
• serialize-javascript moves to 7.1.4 (package-lock.json:2227-2229). This is inside the existing mocha override ^7.0.5 (package.json:28-31), which takes precedence over mocha's own ^6.0.2 (package-lock.json:1751). engines is unchanged at node >=20.0.0 (package-lock.json:2232, node_modules/serialize-javascript/package.json:30-31), and the package is still dev: true.
• The PR changes only version, resolved and integrity on these two entries. No other packages move. I did not check the integrity hashes against the registry.

.github/dependabot.yml

• The config is a valid v2 file: npm ecosystem, directory: / and the required schedule.interval: weekly.
• open-pull-requests-limit: 0 plus a groups entry with applies-to: security-updates and patterns: ["*"] matches the intended behaviour: no routine version-update PRs, and security fixes grouped into one PR.
• I could not check the repository's settings. Security updates still need "Dependabot security updates" turned on there.
• Optional, not a defect: only npm is covered. The workflows pin actions such as actions/checkout@v4 and actions/setup-node@v4 (.github/workflows/node.js.yml:20-22, .github/workflows/publish.yml:20-24), so a github-actions entry could be added later.

Checked claims from the PR description

• "Headers are only passed as plain objects and sensitiveHeaders is never set": confirmed. Headers are plain object literals at src/common/rollbar-api.js:25, src/common/rollbar-api.js:77-81 and src/sourcemaps/signed-url-uploader.js:67-69. A grep of src/ finds no sensitiveHeaders, beforeRedirect or maxRedirects.
• "Supersedes Bump follow-redirects from 1.16.0 to 1.16.1 #45" is stated but was not verified, because that PR is not checked out here.
• The test, lint and npm audit results come from the description. The diff cannot confirm them.

Pre-existing, outside this diff (not a finding)

• The CI build matrix still includes Node 18 (.github/workflows/node.js.yml:36-37). But serialize-javascript 7.x declares node >=20.0.0, and this was already true with 7.1.2.
• CI runs npm install rather than npm ci (.github/workflows/node.js.yml:25,56), so the engine mismatch only produces a warning.
• The PR does not change either point, but the Node 18 leg may deserve a separate look.