chore(deps): update dependency react-router@>=7.0.0 <7.18.0 to v7.18.2 [security] - #511
chore(deps): update dependency react-router@>=7.0.0 <7.18.0 to v7.18.2 [security]#511renovate[bot] wants to merge 1 commit into
Conversation
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 60a13695e5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| '@swc/helpers': 0.5.23 | ||
| lru-cache: 10.4.3 | ||
| react-router: 7.18.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8) | ||
| react-router: 8.3.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8) |
There was a problem hiding this comment.
For Modern.js workspaces that install @modern-js/runtime with @modern-js/plugin-ssg (the repo's examples/modern-js does), this lockfile entry makes @modern-js/runtime-utils resolve react-router@8.3.0 while the same lockfile still gives @modern-js/plugin-ssg its optional react-router-dom@7.18.1, whose own dependency is react-router@7.18.1. That creates two React Router copies/majors in one app; providers and hooks/components from different router copies do not share React Router context, so SSG/runtime routing can fail after install. Please upgrade the Modern.js/SSG stack to a router-v8-compatible version or keep this override on a compatible v7 fix.
Useful? React with 👍 / 👎.
60a1369 to
400cdb6
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 400cdb6c95
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| js-yaml@>=4.0.0 <4.3.0: 4.3.0 | ||
| postcss: 8.5.23 | ||
| react-router@>=7.0.0 <7.18.0: 7.18.1 | ||
| react-router@>=7.0.0 <7.18.0: 8.3.0 |
There was a problem hiding this comment.
For the GHSA-qwww-vcr4-c8h2 affected range (react-router >=7.12.0 <8.3.0), this override only catches packages that request <7.18.0. The lockfile still keeps the catalog react-router-dom@7.18.1 consumers in examples/rollup-sample-lib and examples/rspack-nx-mf, and those snapshots pull react-router@7.18.1, so this security update leaves vulnerable v7 copies installed while the advisory remains ignored in auditConfig. Please either update/remove the remaining v7 DOM consumers or stop suppressing the advisory for the copies that cannot be upgraded yet.
Useful? React with 👍 / 👎.
07a2b47 to
54fb46d
Compare
54fb46d to
4107f10
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
1e17080 to
ecbeda9
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ecbeda9687
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| '@swc/helpers': 0.5.23 | ||
| lru-cache: 10.4.3 | ||
| react-router: 7.18.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8) | ||
| react-router: 7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8) |
There was a problem hiding this comment.
Fresh evidence in the current lockfile is that this changed resolution puts @modern-js/runtime-utils on react-router 7.18.2 while examples/modern-js installs both @modern-js/plugin-ssg and @modern-js/runtime (examples/modern-js/package.json:15-16), and the SSG side still resolves react-router-dom 7.18.1 (pnpm-lock.yaml:19817) whose dependency remains react-router 7.18.1 (pnpm-lock.yaml:31877). That leaves the Modern SSG/runtime app with two React Router module instances, so providers/hooks from the SSG DOM copy and runtime copy will not share router context; please align react-router-dom to the same fixed router version or keep the runtime override on the shared version.
Useful? React with 👍 / 👎.
ecbeda9 to
0c5ae18
Compare
This PR contains the following updates:
7.18.1→7.18.2](https://renovatebot.com/diffs/npm/react-router@>=7.0.0 <7.18.0/7.18.1/7.18.2)React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666 / GHSA-337j-9hxr-rhxg
More information
Details
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6
More information
Details
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
GHSA-qwww-vcr4-c8h2
More information
Details
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
remix-run/react-router (react-router@>=7.0.0 <7.18.0)
v7.18.2: v7.18.2Compare Source
See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.