[guyofeck]

Goal

Get main CI green again. Two checks were failing, and #357 caused neither of them.

The fix

1. Upgrade follow-redirects from 1.16.1 to 1.16.2 (package-lock.json only).
   Security Audit failed because 1.16.1, which comes in through axios, has a high security advisory: GHSA-mrwp-f3q8-3g9p. 1.16.2 fixes it. axios already accepts 1.16.2 (^1.16.0), so the lockfile is the only change.

2. Pin the actions in check-wix-proxy.yml to commit SHAs (actions/checkout@v4 and actions/setup-python@v6 → full SHAs).
   GitHub refused to start this workflow on any run since at least Oct 21 (startup_failure). It was the only workflow still referencing actions by tag, and every SHA-pinned workflow starts fine. That fits an org rule requiring SHA-pinned actions.

No SDK code changes, and the audit workflow itself is unchanged.

Why the upgrade wasn't done earlier

1.16.2 has been on npm since Oct 25, but the Wix npm gateway our CI installs through answered 403 for it until this morning (failed run). It serves 1.16.2 now.

Evidence

Before (on main):

• Security Audit ❌ https://github.com/base44/javascript-sdk/actions/runs/41398302712
• Check Wix Gateway Proxy startup_failure https://github.com/base44/javascript-sdk/actions/runs/41292259529

After (this PR):

• Security Audit ✅ https://github.com/base44/javascript-sdk/actions/runs/41412857088
• Check Wix Gateway Proxy ✅ https://github.com/base44/javascript-sdk/actions/runs/41412856986
• Unit Tests ✅ https://github.com/base44/javascript-sdk/actions/runs/41412857042
• Lint ✅ https://github.com/base44/javascript-sdk/actions/runs/41412856994

Screenshots / video

Not applicable: this PR only changes the lockfile and CI config, and nothing it touches has a UI. The CI run links above are the evidence.

🤖 Generated with Claude Code

https://claude.ai/code/session_012ZeH66ieSwEVEmXBvFWP9t

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.57-pr.359.9ff5e66

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.57-pr.359.9ff5e66"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.57-pr.359.9ff5e66"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.57-pr.359.9ff5e66
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}