fix(dts-plugin): update koa to 2.16.2 to fix CVE-2025-8129

[ScriptedAlchemy]

Summary

• Fix open redirect vulnerability (GHSA-jgmv-j7ww-jx2x) in koa dependency
• Update koa from 2.16.1 to 2.16.2 in dts-plugin package
• Addresses security issue reported in Security issue in dependencies (koa) #3962

Security Issue Details

CVE: CVE-2025-8129
Severity: Low (CVSS 2.0)
Type: Open Redirect vulnerability (CWE-601)

The vulnerability affects koa's redirect functionality when using the "back" redirect option. Attackers could manipulate the user-controllable Referrer header to redirect users to malicious external sites.

Fix Details

• Version Update: koa 2.16.1 → 2.16.2
• Security Fix: Version 2.16.2 restricts "back" redirects to same-origin only
• Affected Package: @module-federation/dts-plugin only
• Impact: Prevents open redirect attacks in the DTS plugin's HTTP server

Test Plan

• All existing tests pass (83 tests across 12 test files)
• No breaking changes to koa server functionality
• Security vulnerability is resolved with version 2.16.2

Verification

• Lock file updated: pnpm-lock.yaml includes [email protected]
• Single dependency: Only dts-plugin package uses koa in this codebase
• Backward compatible: No API changes between 2.16.1 and 2.16.2

Fixes #3962

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: bd7ff93

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	4471d83
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/688bb15cda4c5100086c9108
😎 Deploy Preview	https://deploy-preview-3963--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.