From ba6372d555eba81d12bd76925a1f808054bcb2c6 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp <19+brynary@users.noreply.github.com> Date: Sat, 27 Jun 2026 11:10:39 -0500 Subject: [PATCH] security: patch react-router CVE alerts (#535) ## Summary - Updates direct web runtime dependency `react-router` from `7.12.0` to `7.15.1` in `apps/fabro-web`. - Regenerates the root Bun workspace lockfile. - Expected to resolve Dependabot alerts: - https://github.com/fabro-sh/fabro/security/dependabot/31 - https://github.com/fabro-sh/fabro/security/dependabot/32 - https://github.com/fabro-sh/fabro/security/dependabot/33 - https://github.com/fabro-sh/fabro/security/dependabot/34 - https://github.com/fabro-sh/fabro/security/dependabot/35 - https://github.com/fabro-sh/fabro/security/dependabot/36 - https://github.com/fabro-sh/fabro/security/dependabot/37 ## Grouping - Grouped these alerts because they all affect the same direct package, same manifest, same runtime scope, and same verification path. - Kept separate from the Rust `tar` alert because it touches a different ecosystem and lockfile. ## Verification - `bun pm why react-router` resolves `react-router@7.15.1` for `fabro-web`. - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun test --isolate` (625 passed, 0 failed) - `cd apps/fabro-web && bun run build` - `git diff --check` ## Residual alerts - Rust `tar` alert 30 is handled separately in https://github.com/fabro-sh/fabro/pull/534. Co-authored-by: Release Repro --- apps/fabro-web/package.json | 2 +- bun.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/fabro-web/package.json b/apps/fabro-web/package.json index 4c3bdda71..ff51ce088 100644 --- a/apps/fabro-web/package.json +++ b/apps/fabro-web/package.json @@ -32,7 +32,7 @@ "marked": "^18.0.0", "react": "^19.2.4", "react-dom": "^19.2.4", - "react-router": "7.12.0", + "react-router": "7.15.1", "remark-gfm": "^4.0.1", "sonner": "^2.0.7", "swr": "^2.4.1" diff --git a/bun.lock b/bun.lock index 4bb92d378..bd69d07d6 100644 --- a/bun.lock +++ b/bun.lock @@ -29,7 +29,7 @@ "marked": "^18.0.0", "react": "^19.2.4", "react-dom": "^19.2.4", - "react-router": "7.12.0", + "react-router": "7.15.1", "remark-gfm": "^4.0.1", "sonner": "^2.0.7", "swr": "^2.4.1", @@ -1534,7 +1534,7 @@ "react-remove-scroll-bar": ["react-remove-scroll-bar@2.3.8", "", { "dependencies": { "react-style-singleton": "^2.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react"] }, "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q=="], - "react-router": ["react-router@7.12.0", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-kTPDYPFzDVGIIGNLS5VJykK0HfHLY5MF3b+xj0/tTyNYL1gF1qs7u67Z9jEhQk2sQ98SUaHxlG31g1JtF7IfVw=="], + "react-router": ["react-router@7.15.1", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-R8rl9HhgikFYoPJymnUtPXWbnDb3oget6lQnfIoupbt61aT9aOhRkDsY2XRhZRyX1Z/8a5sL74fXmFNm3NRK5A=="], "react-style-singleton": ["react-style-singleton@2.2.3", "", { "dependencies": { "get-nonce": "^1.0.0", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ=="],