Skip to content

chore: Remediate 3 Dependabot security alerts (react-router-dom 6→7) - #163

Merged
ernst-dev merged 1 commit into
mainfrom
dependabot-remediate/security-remediation-20260807
Aug 10, 2026
Merged

chore: Remediate 3 Dependabot security alerts (react-router-dom 6→7)#163
ernst-dev merged 1 commit into
mainfrom
dependabot-remediate/security-remediation-20260807

Conversation

@ernst-dev

Copy link
Copy Markdown
Member

Summary

Upgrades react-router-dom from ^6.30.4 to ^7.18.2 (dev dependency) to resolve all 3 open Dependabot security alerts.

NPMPM availability

Not applicable — all upgraded packages are dev-only (dev: true). No non-dev dependency versions increased.

Alerts resolved

Package Major line Vulnerable range Resolved version Severity Advisory
react-router 6.x >= 6.0.0, < 7.18.0 7.18.2 medium GHSA-wrjc-x8rr-h8h6 / CVE-2026-53669
react-router 6.x >= 6.4.0, < 7.18.0 7.18.2 medium GHSA-337j-9hxr-rhxg / CVE-2026-53666
react-router-dom 6.x >= 6.30.2, <= 6.30.4 7.18.2 medium GHSA-jjmj-jmhj-qwj2 / CVE-2026-53668

Remediation details

  • Rung used: 2 (npm audit fix --force)
  • Override added: No
  • Classification:
    • ALERT-DRIVEN: react-router 6.30.4 → 7.18.2, react-router-dom 6.30.4 → 7.18.2
    • COLLATERAL: js-yaml 4.3.0 → 4.3.1 (also security-relevant), cookie@1.1.1 added, set-cookie-parser@2.7.2 added, @remix-run/router@1.23.3 removed, yaml@2.9.0 removed

Unresolved alerts

None — merging this PR is expected to CLEAR ALL 3 open Dependabot alerts for this repo.

@ernst-dev
ernst-dev requested a review from a team as a code owner August 7, 2026 12:31
@ernst-dev
ernst-dev requested review from taheramr and removed request for a team August 7, 2026 12:31
@codecov

codecov Bot commented Aug 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.79%. Comparing base (d200138) to head (403da10).

❌ Your project check has failed because the head coverage (87.79%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #163   +/-   ##
=======================================
  Coverage   87.79%   87.79%           
=======================================
  Files          25       25           
  Lines         344      344           
  Branches       95       95           
=======================================
  Hits          302      302           
  Misses         42       42           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Upgrade react-router-dom from ^6.30.4 to ^7.18.2 to resolve:
- GHSA-wrjc-x8rr-h8h6 (react-router open redirect, CVE-2026-53669)
- GHSA-337j-9hxr-rhxg (react-router constructor injection, CVE-2026-53666)
- GHSA-jjmj-jmhj-qwj2 (react-router-dom, CVE-2026-53668)

All affected packages are dev-only dependencies.
@ernst-dev
ernst-dev enabled auto-merge August 10, 2026 10:07
@ernst-dev
ernst-dev added this pull request to the merge queue Aug 10, 2026
Merged via the queue into main with commit 3f11618 Aug 10, 2026
82 of 86 checks passed
@ernst-dev
ernst-dev deleted the dependabot-remediate/security-remediation-20260807 branch August 10, 2026 10:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants