[ChiragAgg5k]

What

Patches newly published advisories by moving lockfile entries only. No package.json ranges change.

Package	Lockfile	From	To	Advisory
follow-redirects	appwrite/package-lock.json	1.16.1	1.16.2	GHSA-mrwp-f3q8-3g9p (high)
follow-redirects	functions/rejectProject/package-lock.json	1.16.1	1.16.2	GHSA-mrwp-f3q8-3g9p (high)
seroval	package-lock.json	1.6.8	1.6.12	GHSA-9wx9-5pv9-3349, GHSA-f86p-h4j2-7qgj
seroval-plugins	package-lock.json	1.6.8	1.6.12	kept in step with seroval

Why these versions

follow-redirects comes in through axios (^1.16.0), so npm update follow-redirects --package-lock-only was enough in both subprojects.

seroval comes in through the TanStack Start/Router packages (^1.6.7). I stayed on the 1.6.x patch line at 1.6.12 instead of the 1.7.6 that a plain update picks. 1.7.6 is two days old, and 1.6.12 clears both advisories while respecting the repo's 7-day Dependabot cooldown.

glob and minimatch do not appear in any lockfile in this repo, so nothing changes for them.

Verification

• npm ci in the root, appwrite/ and functions/rejectProject/: 0 vulnerabilities each
• npm run build in the root passes
• No vulnerable follow-redirects, seroval, glob or minimatch versions remain in any lockfile

[hansi-codes]

🟢 Tier S · Ready to merge

Updates the follow-redirects lockfile entries in the Appwrite and rejectProject subprojects from 1.16.1 to 1.16.2. Updates the root lockfile entries for seroval and seroval-plugins from 1.6.8 to 1.6.12 without changing manifest ranges.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 3

File	Change
appwrite/package-lock.json	Bumps the locked follow-redirects package to 1.16.2.
functions/rejectProject/package-lock.json	Bumps the locked follow-redirects package to 1.16.2.
package-lock.json	Bumps locked seroval and seroval-plugins packages to 1.6.12.

---

_{Reviewed c53790f · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary