From 97b77097b6f24aa8307764ad8d616ab526e32cb4 Mon Sep 17 00:00:00 2001 From: Alessio Date: Wed, 19 Aug 2026 21:53:50 +0100 Subject: [PATCH] chore(deps): clear the six open Dependabot alerts (react-router, undici) All six open alerts are npm, transitive, and confined to frontend/pnpm-lock.yaml. None is exploitable in this deployment, but each fix lands inside the ranges already declared, so fixing costs less than arguing. react-router 7.18.1 -> 7.18.2 closes alert #26 (GHSA-qwww-vcr4-c8h2, HIGH: RSC mode CSRF bypass, a follow-up to CVE-2026-22030). The vulnerable path is RSC mode and server actions, which a client-only Vite SPA with no server entry never enters. Bumping react-router alone is a no-op: react-router-dom pins it to an exact version, so the parent moves and drags it along. The advisory now reports 7.18.2 as the first patched version, i.e. the fix was backported into the 7.x line, so the v8 migration this used to require (v8 deletes react-router-dom and moves 16 import sites) is no longer part of the picture. undici 7.28.0 -> 7.29.0 closes alerts #20 through #24 (one HIGH, four MEDIUM: degenerate private cache directives, CRLF injection via a blob-like body type, cookie attribute injection, cross-user disclosure via whitespace in Cache-Control, and response desynchronization in the retry interceptor). undici is reachable only through jsdom, a devDependency serving as the Vitest DOM environment, so it never enters the shipped bundle, and every one of these needs the test process to make real requests to a hostile server. jsdom declares ^7.25.0, so it takes 7.29.0 without being upgraded itself. package.json moves with the lock rather than being held at ^7.18.1. Leaving the declared floor at the vulnerable version means a lockfile regeneration can legitimately resolve back to 7.18.1 and reopen the alert; the security floor belongs where the constraint lives. Five unrelated transitive patches ride along, because pnpm re-resolves on update: color-name 2.1.0 -> 2.1.1, color-parse 2.0.2 -> 2.1.2, earcut 3.2.0 -> 3.2.3, probe-image-size 7.3.0 -> 7.4.0, sax 1.6.0 -> 1.6.1. Hand-editing the lockfile to suppress them would be a larger risk than the bumps themselves. Verified: `pnpm install --frozen-lockfile` accepts the pair, so the lock and the manifest agree the way CI installs them; 148 frontend tests pass, including the 42 router-aware page tests; eslint, `tsc -b` and `vite build` clean. The installed tree holds exactly one copy of each package, at the patched version, so no vulnerable duplicate survives to keep an alert open. Co-Authored-By: Claude Opus 5 (1M context) --- frontend/package.json | 2 +- frontend/pnpm-lock.yaml | 134 ++++++++++++++++++++++------------------ 2 files changed, 76 insertions(+), 60 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index d6256ede..48ec2893 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -34,7 +34,7 @@ "react": "^19.2.6", "react-dom": "^19.2.6", "react-plotly.js": "^4.0.0", - "react-router-dom": "^7.18.1", + "react-router-dom": "^7.18.2", "sonner": "^2.0.7", "tailwind-merge": "^3.6.0" }, diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml index cd050679..6af47bce 100644 --- a/frontend/pnpm-lock.yaml +++ b/frontend/pnpm-lock.yaml @@ -69,8 +69,8 @@ importers: specifier: ^4.0.0 version: 4.0.0(plotly.js@3.6.0(mapbox-gl@1.13.3))(react@19.2.6) react-router-dom: - specifier: ^7.18.1 - version: 7.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + specifier: ^7.18.2 + version: 7.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6) sonner: specifier: ^2.0.7 version: 2.0.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6) @@ -175,6 +175,10 @@ packages: resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==} engines: {node: '>=6.9.0'} + '@babel/code-frame@7.29.7': + resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==} + engines: {node: '>=6.9.0'} + '@babel/compat-data@7.29.3': resolution: {integrity: sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==} engines: {node: '>=6.9.0'} @@ -213,6 +217,10 @@ packages: resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==} engines: {node: '>=6.9.0'} + '@babel/helper-validator-identifier@7.29.7': + resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==} + engines: {node: '>=6.9.0'} + '@babel/helper-validator-option@7.27.1': resolution: {integrity: sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==} engines: {node: '>=6.9.0'} @@ -1294,20 +1302,20 @@ packages: '@types/react-dom': optional: true - '@turf/area@7.3.5': - resolution: {integrity: sha512-sSn80wPT7XfBIDN3vurCPxhk9W4U8ozS/XImSqeLN8qveTICOxzZkhsGDMp0CuncaN+plWut4a2TdNM7mzZB6Q==} + '@turf/area@7.4.0': + resolution: {integrity: sha512-B7q5f6QwKIxxbl4/L59lAYA+FF7h2hv6st96PuKue0TGCYGSxAG/lV8LHSPUSOuOrLywN4jytJcKK3vOFBs7Nw==} - '@turf/bbox@7.3.5': - resolution: {integrity: sha512-oG1ya/HtBjAIg4TimbWx+nOYPbY0bCvt82Bq8tm6sBw3qqtbOyRSfDz79Sq90TnH7DXJprJ1qnVGKNtZ6jemfw==} + '@turf/bbox@7.4.0': + resolution: {integrity: sha512-yOX9lALc2GmjYUIE99+nRj7eZA7eDtx7Ixu/hrgIo+YqHvL1reaPVTC9rQWMHMm0pH0/WHjzk8uOpAHjptrudQ==} - '@turf/centroid@7.3.5': - resolution: {integrity: sha512-hkWaqwGFdOn6Tf0EWfn2yn1XZ1FWE1h2C5ZWstDMu/FxYO5DB+YjlmOFPl4K6SmSOEgdV07eK2vDCyPeTHqKGA==} + '@turf/centroid@7.4.0': + resolution: {integrity: sha512-WglCFe+TnMqeYa/LcbUp37NgIF0zHTNYmlxwUm40fyyzyLsYeDq4dgFWLTYpvRNqb5oIMV6xsBjSf+vCPtVJ6w==} - '@turf/helpers@7.3.5': - resolution: {integrity: sha512-E/NMGV5MwbjjP7AJXBtsanC3yY8N2MQ87IGdIgkB2ji5AtBpwnH4L3gEqpYN4RlCJJWbLbzO91BbKv2waUd0eg==} + '@turf/helpers@7.4.0': + resolution: {integrity: sha512-7PAwLZqOdRzTI5g9bHvUwlloAXPDH/mlajtryk0tw4ZwGMtmXsAyF4QundsAMfy4u48Fyd3AUqMXY0SMxqJGWg==} - '@turf/meta@7.3.5': - resolution: {integrity: sha512-r+ohqxoyqeigFB0oFrQx/YEHIkOKqcKpCjvZkvZs7Tkv+IFco5MezAd2zd4rzK+0DfFgDP3KpJc7HqrYjvEjhg==} + '@turf/meta@7.4.0': + resolution: {integrity: sha512-3cLUvlEyDuSnMSzrjhaLAEiYR8xhbfWyTVQlrlEw40xL81d4KF4PqUWbjTXKpXZStdYbet2GCurl79KMypNw6g==} '@tybys/wasm-util@0.10.3': resolution: {integrity: sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==} @@ -1595,8 +1603,8 @@ packages: color-name@1.1.4: resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==} - color-name@2.1.0: - resolution: {integrity: sha512-1bPaDNFm0axzE4MEAzKPuqKWeRaT43U/hyxKPBdqTfmPF+d6n7FSoTFxLVULUJOmiLp01KjhIPPH+HrXZJN4Rg==} + color-name@2.1.1: + resolution: {integrity: sha512-p2FdgwVx1a9yWBHP2wI0VgShkDpgN4kZISkxdNipGBJWpa5G6b04OINlVWCyJj0JmfvcPrgqt95E9k8yvaOJFg==} engines: {node: '>=12.20'} color-normalize@1.5.0: @@ -1605,8 +1613,8 @@ packages: color-parse@1.4.3: resolution: {integrity: sha512-BADfVl/FHkQkyo8sRBwMYBqemqsgnu7JZAwUgvBvuwwuNUZAhSvLTbsEErS5bQXzOjDR0dWzJ4vXN2Q+QoPx0A==} - color-parse@2.0.2: - resolution: {integrity: sha512-eCtOz5w5ttWIUcaKLiktF+DxZO1R9KLNY/xhbV6CkhM7sR3GhVghmt6X6yOnzeaM24po+Z9/S1apbXMwA3Iepw==} + color-parse@2.1.2: + resolution: {integrity: sha512-z0f1xKxh4za/RSprsmxNkFcyO2o/4VJ2QxiiRRIjfqAsqOXys+BvpOCINNAKOX9AQ/alpS03Wc0WMtEmtLmHzw==} color-rgba@2.4.0: resolution: {integrity: sha512-Nti4qbzr/z2LbUWySr7H9dk3Rl7gZt7ihHAxlgT4Ho90EXWkjtkL1avTleu9yeGuqrt/chxTB6GKK8nZZ6V0+Q==} @@ -1816,8 +1824,8 @@ packages: earcut@2.2.4: resolution: {integrity: sha512-/pjZsA1b4RPHbeWZQn66SWS8nZZWLQQ23oE3Eam7aroEFGEvwKAsJfZ9ytiEMycfzXWpca4FA9QIOehf7PocBQ==} - earcut@3.2.0: - resolution: {integrity: sha512-qy0wTgkOKsKC0cHVd4cKFfaO5u7egzs0F2bQ/9l5Pvm0EJM4XDdUMFoCJrxmWc2Fc3sRFa8l6gds8tx+6BcN8g==} + earcut@3.2.3: + resolution: {integrity: sha512-vnS4AVwp1KHAF13i1vp1/2D5evWy3k5u/iW/B81QVsUZtV8cv2tU0b2VNFlqvh4kYwrFMDdjPCfAmfyJW9y14Q==} electron-to-chromium@1.5.353: resolution: {integrity: sha512-kOrWphBi8TOZyiJZqsgqIle0lw+tzmnQK83pV9dZUd01Nm2POECSyFQMAuarzZdYqQW7FH9RaYOuaRo3h+bQ3w==} @@ -2612,8 +2620,8 @@ packages: resolution: {integrity: sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==} engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0} - probe-image-size@7.3.0: - resolution: {integrity: sha512-7CaDeBwiAbh6ohXsvLbAZhO7wzsZAmaevfxe39qvCwRh8LyaZfDlBGGLU1CCTgrTLtCOdwBBhjOrIHaIIimHfQ==} + probe-image-size@7.4.0: + resolution: {integrity: sha512-cdEprVtZxV+awMde9X+4jILBFYh4CARxVrQaMl4wY4YcPWbul9jntXrIW95NInBDyJwcVUP3U0T6yukN8rMBaQ==} process-nextick-args@2.0.1: resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==} @@ -2669,15 +2677,15 @@ packages: '@types/react': optional: true - react-router-dom@7.18.1: - resolution: {integrity: sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==} + react-router-dom@7.18.2: + resolution: {integrity: sha512-AIKJ/jgGlFb3EbfCXk5Gzshiwt+l3mqbCrNjmEWMMjqQxNJ3svBa6bgzFyCC2Sw3RA0VWF1kg3uQf2OFhxb8hw==} engines: {node: '>=20.0.0'} peerDependencies: react: '>=18' react-dom: '>=18' - react-router@7.18.1: - resolution: {integrity: sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==} + react-router@7.18.2: + resolution: {integrity: sha512-aUVMjFm3GAPTTZL7oYr5E7ETiqfQCHRLH+B+5afnICvf0r7kkK4eR6SMuwbSTJw/7t+12khT/Kahij49fqOCIg==} engines: {node: '>=20.0.0'} peerDependencies: react: '>=18' @@ -2757,8 +2765,8 @@ packages: safer-buffer@2.1.2: resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==} - sax@1.6.0: - resolution: {integrity: sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==} + sax@1.6.1: + resolution: {integrity: sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==} engines: {node: '>=11.0.0'} saxes@6.0.0: @@ -2973,8 +2981,8 @@ packages: undici-types@7.16.0: resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} unquote@1.1.1: @@ -3215,6 +3223,12 @@ snapshots: js-tokens: 4.0.0 picocolors: 1.1.1 + '@babel/code-frame@7.29.7': + dependencies: + '@babel/helper-validator-identifier': 7.29.7 + js-tokens: 4.0.0 + picocolors: 1.1.1 + '@babel/compat-data@7.29.3': {} '@babel/core@7.29.0': @@ -3275,6 +3289,8 @@ snapshots: '@babel/helper-validator-identifier@7.28.5': {} + '@babel/helper-validator-identifier@7.29.7': {} + '@babel/helper-validator-option@7.27.1': {} '@babel/helpers@7.29.2': @@ -4232,7 +4248,7 @@ snapshots: '@testing-library/dom@10.4.1': dependencies: - '@babel/code-frame': 7.29.0 + '@babel/code-frame': 7.29.7 '@babel/runtime': 7.29.7 '@types/aria-query': 5.0.4 aria-query: 5.3.0 @@ -4260,35 +4276,35 @@ snapshots: '@types/react': 19.2.14 '@types/react-dom': 19.2.3(@types/react@19.2.14) - '@turf/area@7.3.5': + '@turf/area@7.4.0': dependencies: - '@turf/helpers': 7.3.5 - '@turf/meta': 7.3.5 + '@turf/helpers': 7.4.0 + '@turf/meta': 7.4.0 '@types/geojson': 7946.0.16 tslib: 2.8.1 - '@turf/bbox@7.3.5': + '@turf/bbox@7.4.0': dependencies: - '@turf/helpers': 7.3.5 - '@turf/meta': 7.3.5 + '@turf/helpers': 7.4.0 + '@turf/meta': 7.4.0 '@types/geojson': 7946.0.16 tslib: 2.8.1 - '@turf/centroid@7.3.5': + '@turf/centroid@7.4.0': dependencies: - '@turf/helpers': 7.3.5 - '@turf/meta': 7.3.5 + '@turf/helpers': 7.4.0 + '@turf/meta': 7.4.0 '@types/geojson': 7946.0.16 tslib: 2.8.1 - '@turf/helpers@7.3.5': + '@turf/helpers@7.4.0': dependencies: '@types/geojson': 7946.0.16 tslib: 2.8.1 - '@turf/meta@7.3.5': + '@turf/meta@7.4.0': dependencies: - '@turf/helpers': 7.3.5 + '@turf/helpers': 7.4.0 '@types/geojson': 7946.0.16 tslib: 2.8.1 @@ -4596,7 +4612,7 @@ snapshots: color-name@1.1.4: {} - color-name@2.1.0: {} + color-name@2.1.1: {} color-normalize@1.5.0: dependencies: @@ -4608,9 +4624,9 @@ snapshots: dependencies: color-name: 1.1.4 - color-parse@2.0.2: + color-parse@2.1.2: dependencies: - color-name: 2.1.0 + color-name: 2.1.1 color-rgba@2.4.0: dependencies: @@ -4619,7 +4635,7 @@ snapshots: color-rgba@3.0.0: dependencies: - color-parse: 2.0.2 + color-parse: 2.1.2 color-space: 2.3.2 color-space@2.3.2: {} @@ -4803,7 +4819,7 @@ snapshots: earcut@2.2.4: {} - earcut@3.2.0: {} + earcut@3.2.3: {} electron-to-chromium@1.5.353: {} @@ -5272,7 +5288,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.1 - undici: 7.28.0 + undici: 7.29.0 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -5426,7 +5442,7 @@ snapshots: '@types/mapbox__vector-tile': 1.3.4 '@types/pbf': 3.0.5 '@types/supercluster': 7.1.3 - earcut: 3.2.0 + earcut: 3.2.3 geojson-vt: 4.0.3 gl-matrix: 3.4.4 global-prefix: 4.0.0 @@ -5469,7 +5485,7 @@ snapshots: dependencies: debug: 3.2.7 iconv-lite: 0.4.24 - sax: 1.6.0 + sax: 1.6.1 transitivePeerDependencies: - supports-color @@ -5562,9 +5578,9 @@ snapshots: '@plotly/d3-sankey-circular': 0.33.1 '@plotly/mapbox-gl': 1.13.4(mapbox-gl@1.13.3) '@plotly/regl': 2.1.2 - '@turf/area': 7.3.5 - '@turf/bbox': 7.3.5 - '@turf/centroid': 7.3.5 + '@turf/area': 7.4.0 + '@turf/bbox': 7.4.0 + '@turf/centroid': 7.4.0 base64-arraybuffer: 1.0.2 color-normalize: 1.5.0 color-rgba: 3.0.0 @@ -5589,7 +5605,7 @@ snapshots: parse-svg-path: 0.1.2 point-in-polygon: 1.1.0 polybooljs: 1.2.2 - probe-image-size: 7.3.0 + probe-image-size: 7.4.0 regl-error2d: 2.0.12 regl-line2d: 3.1.3 regl-scatter2d: 3.4.0 @@ -5632,7 +5648,7 @@ snapshots: ansi-styles: 5.2.0 react-is: 17.0.2 - probe-image-size@7.3.0: + probe-image-size@7.4.0: dependencies: lodash.merge: 4.6.2 needle: 2.9.1 @@ -5685,13 +5701,13 @@ snapshots: optionalDependencies: '@types/react': 19.2.14 - react-router-dom@7.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6): + react-router-dom@7.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6): dependencies: react: 19.2.6 react-dom: 19.2.6(react@19.2.6) - react-router: 7.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + react-router: 7.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6) - react-router@7.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6): + react-router@7.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6): dependencies: cookie: 1.1.1 react: 19.2.6 @@ -5825,7 +5841,7 @@ snapshots: safer-buffer@2.1.2: {} - sax@1.6.0: {} + sax@1.6.1: {} saxes@6.0.0: dependencies: @@ -6020,7 +6036,7 @@ snapshots: undici-types@7.16.0: {} - undici@7.28.0: {} + undici@7.29.0: {} unquote@1.1.1: {}