archetech / archon / 33287406633

87%

push

github

fix(deps): Move explorer and gatekeeper-client to react-router v7 (#973)

Two moderate advisories affect react-router 6 and neither has a fix in
that line: GHSA-337j-9hxr-rhxg (arbitrary constructor injection via
deserializeErrors) and GHSA-wrjc-x8rr-h8h6 (open redirect via backslash
in <Link>/useNavigate) are first patched in 7.18.0.

Dependabot proposed 6.30.4 -> 6.30.5 for both apps (#969, #970), but
6.30.5 is itself vulnerable to both, so dependency-review could never pass
on any v6 release. The v7 major is the only route off the advisories.

apps/herald-client was already on v7, so this brings the other two in
line. Both use a narrow slice of the API -- BrowserRouter, Routes, Route,
Navigate, useNavigate, useLocation, useSearchParams -- all unchanged in
v7, across two import sites each. The lockfile deltas are three entries
apiece: @remix-run/router out, cookie and set-cookie-parser in.

Closes #972


Claude-Session: https://claude.ai/code/session_01GYGMfX3foBcVqP7AQNXjWj

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

3881 of 4464 branches covered (86.94%)

Branch coverage included in aggregate %.

8528 of 8953 relevant lines covered (95.25%)

717.55 hits per line