fix: update follow-redirects to 1.14.7

[Trott]

Fixes: #1563

[james-portelli-cko]

Hey @indexzero by any chance would you be able (or perhaps know of someone with permissions) to merge and release this to resolve the security concerns? :)

[Trott]

Hey @indexzero by any chance would you be able (or perhaps know of someone with permissions) to merge and release this to resolve the security concerns? :)

Maybe @jcrugzz?

@james-portelli-cko As you may know (but if so, then for readers following along), this isn't necessary to fix the vulnerability warnings. If you reinstall http-proxy, you should get the fixed follow-redirects. It would still be good (in my opinion) to merge this and publish a new release for a few reasons, but consumers can solve the problem now without it.

[MZOG]

@Trott I've deleted node_modules, removed package-lock, then reinstall http-proxy and I'm still getting old follow-redirects : /

"http-proxy": {
    "version": "1.18.1",
    "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
    "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
    "dev": true,
    "requires": {
        "eventemitter3": "^4.0.0",
        "follow-redirects": "^1.0.0",
        "requires-port": "^1.0.0"
    }
},

[Trott]

@Trott I've deleted node_modules, removed package-lock, then reinstall http-proxy and I'm still getting old follow-redirects : /

"http-proxy": {
    "version": "1.18.1",
    "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
    "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
    "dev": true,
    "requires": {
        "eventemitter3": "^4.0.0",
        "follow-redirects": "^1.0.0",
        "requires-port": "^1.0.0"
    }
},

The snippet you are showing does not necessarily mean that a vulnerable version of follow-redirects is installed. Use npm ls follow-redirects to check the installed version. If it is vulnerable, check if you have an npm-shrinkwrap.json file and/or a yarn.lock file and be sure to remove them as well when re-installing.

[Trott]

I suppose this repo is inactive.