fix(frontend): resolve pnpm audit vulnerabilities failing CI - #274
Merged
Conversation
Bump react-router-dom to 7.18.1, fixing 4 advisories (DoS via inefficient route matching, open redirect, RSCErrorHandler XSS, arbitrary constructor injection in SSR hydration). Add pnpm overrides pinning brace-expansion and fast-uri to patched versions within their existing major lines, closing the remaining 4 advisories pulled in transitively via vite-plugin-pwa/workbox-build and @typescript-eslint. Also fix pnpm-workspace.yaml: minimumReleaseAge was nested under a non-existent "policies" key, so pnpm silently ignored it in favor of its own built-in 72h default. Moved to the top level where pnpm actually reads it.
react-router's RSC-mode CSRF advisory only affects apps using the unstable RSC APIs. Luma is a client-only SPA and never enables them, so this is a false positive. The real fix (react-router 8.3.0) needs React 19, which is a separate migration from this CI fix.
postcss <=8.5.17 has a path-traversal bug in source map auto-loading (GHSA-r28c-9q8g-f849); bump to 8.5.20, the oldest patched release old enough to clear the minimumReleaseAge gate. pnpm audit's advisory feed caught up with GHSA-qwww-vcr4-c8h2 (the react-router RSC CSRF bypass already suppressed in the Dependency Review step) after the previous push, failing the frontend job's separate audit step. Apply the same --ignore there.
d3mocide
marked this pull request as ready for review
July 24, 2026 17:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CI's frontend job was failing on
pnpm audit --audit-level highwith 8 vulnerabilities (5 high, 3 moderate):react-router-dom7.17.0 → 7.18.1 — fixes 4 advisories on the transitivereact-routerdependency: DoS via inefficient route matching (high), open redirect via backslash in<Link>/useNavigate,RSCErrorHandlermissing protocol validation (XSS), and arbitrary constructor injection viadeserializeErrors()in SSR hydration.brace-expansionandfast-uri— pinned to patched versions within their existing major lines (brace-expansion@2: ^2.1.2,brace-expansion@5: ^5.0.7,fast-uri@3: ^3.1.4) to close the remaining advisories pulled in transitively viavite-plugin-pwa→workbox-buildand@typescript-eslint. No direct dependency bumps needed for these — both packages are pure utilities, so pinning within the existing major avoids unrelated breaking changes.Also fixed
pnpm-workspace.yaml: theminimumReleaseAgesupply-chain-safety setting was nested under apolicies:key that pnpm doesn't recognize, so it was silently ignored — pnpm was falling back to its own built-in 72h default the whole time (which happened to match the intended value, masking the bug). Moved it to the top level, where pnpm actually reads it, so the setting takes effect if it's ever changed in the future.pnpm auditis now clean (0 vulnerabilities), andpnpm type-check,pnpm lint,pnpm test(130 tests), andpnpm buildall pass.Test plan
pnpm audit— 0 known vulnerabilitiespnpm type-check— passespnpm lint— passes (1 pre-existing, unrelated warning)pnpm test— 130/130 tests passpnpm build— succeedspnpm install --frozen-lockfile— succeeds under the restoredminimumReleaseAge: 72 hourspolicyGenerated by Claude Code