From 06007446fba91835425482b021e8b4c2cfef75bc Mon Sep 17 00:00:00 2001 From: Devanshu Rajesh Chicholikar Date: Mon, 8 Jun 2026 15:50:35 -0400 Subject: [PATCH] chore(deps): bump react-router-dom to ^7.15.0 (fixes 4 HIGH react-router CVEs) Trivy flagged react-router 7.13.0 (transitive via react-router-dom) with 4 HIGH CVEs: CVE-2026-33245 (XSS in RSC redirect), -34077 (DoS), -42211 (turbo-stream arbitrary constructor), -42342 (DoS via unbounded path expansion). All fixed by <=7.15.0; bumping the floor resolves react-router to 7.17.0, clearing all four. Validated: frontend typecheck clean, 13 vitest tests pass, build succeeds. Dependency bump only, no code changes. --- frontend/bun.lock | 6 +++--- frontend/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/frontend/bun.lock b/frontend/bun.lock index b540c39..d8abc9b 100644 --- a/frontend/bun.lock +++ b/frontend/bun.lock @@ -36,7 +36,7 @@ "next-themes": "^0.4.6", "react": "^18.2.0", "react-dom": "^18.2.0", - "react-router-dom": "^7.12.0", + "react-router-dom": "^7.15.0", "react-syntax-highlighter": "^16.1.0", "sigma": "^3.0.2", "sonner": "^2.0.7", @@ -884,9 +884,9 @@ "react-remove-scroll-bar": ["react-remove-scroll-bar@2.3.8", "", { "dependencies": { "react-style-singleton": "^2.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q=="], - "react-router": ["react-router@7.13.0", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" } }, "sha512-PZgus8ETambRT17BUm/LL8lX3Of+oiLaPuVTRH3l1eLvSPpKO3AvhAEb5N7ihAFZQrYDqkvvWfFh9p0z9VsjLw=="], + "react-router": ["react-router@7.17.0", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-FDELK7rTMlCHO5+reyXsPlmfr7N1F91lPHsWYfMEGQm/KQ+F4JFM8jGoeQDmDvdTs93Fw9aSilH+uKRb4/jXvQ=="], - "react-router-dom": ["react-router-dom@7.13.0", "", { "dependencies": { "react-router": "7.13.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" } }, "sha512-5CO/l5Yahi2SKC6rGZ+HDEjpjkGaG/ncEP7eWFTvFxbHP8yeeI0PxTDjimtpXYlR3b3i9/WIL4VJttPrESIf2g=="], + "react-router-dom": ["react-router-dom@7.17.0", "", { "dependencies": { "react-router": "7.17.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" } }, "sha512-fyU2yjGups/hE6Xz0I5ZYbVL8Gx29eCjgpHaRaTaVU+OOAdfRX05KsvyRm0GO8YQwOkhpU3MurW1jyMUJn+zSw=="], "react-style-singleton": ["react-style-singleton@2.2.3", "", { "dependencies": { "get-nonce": "^1.0.0", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ=="], diff --git a/frontend/package.json b/frontend/package.json index 3f704b3..6e83a24 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -45,7 +45,7 @@ "next-themes": "^0.4.6", "react": "^18.2.0", "react-dom": "^18.2.0", - "react-router-dom": "^7.12.0", + "react-router-dom": "^7.15.0", "react-syntax-highlighter": "^16.1.0", "sigma": "^3.0.2", "sonner": "^2.0.7",