chore(deps): bump react-router-dom to ^7.15.0 (fixes 4 HIGH react-router CVEs)#317
Conversation
…ter CVEs) Trivy flagged react-router 7.13.0 (transitive via react-router-dom) with 4 HIGH CVEs: CVE-2026-33245 (XSS in RSC redirect), -34077 (DoS), -42211 (turbo-stream arbitrary constructor), -42342 (DoS via unbounded path expansion). All fixed by <=7.15.0; bumping the floor resolves react-router to 7.17.0, clearing all four. Validated: frontend typecheck clean, 13 vitest tests pass, build succeeds. Dependency bump only, no code changes.
|
@DevanshuNEU is attempting to deploy a commit to the Dev's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
More reviews will be available in 16 minutes and 1 second. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
1 participant
Summary
Bumps
react-router-dom(floor^7.15.0, resolves to 7.17.0) to clear 4 HIGHreact-routerCVEs that Trivy flags on every PR's Security Scan.CVEs fixed (all in transitive
react-router7.13.0)__manifest(fixed 7.15.0)Changes
frontend/package.json:react-router-dom^7.12.0to^7.15.0frontend/bun.lock:react-router/react-router-dom7.13.0 to 7.17.0Validation
bun run typecheckcleanbun run test- 13 passedbun run build- succeedsDependency bump only, no code changes. Unblocks the Security Scan check on other open PRs (e.g. #316) once merged into main.