[Security] Upgrade React Router past RSC CSRF advisory #269

New Issue

2026-07-28T01:36:32+02:00

zemion commented

2026-07-28 01:36:32 +02:00

Problem

npm audit reports GHSA-qwww-vcr4-c8h2 against the installed React Router 7 release. The available automated remediation crosses into React Router 8, so it requires an intentional compatibility migration rather than npm audit fix --force. GovOPlaN currently uses client-side routing rather than React Server Components, which likely narrows immediate exposure, but the vulnerable production dependency must remain visible and be removed.

The PostCSS GHSA-r28c-9q8g-f849 advisory found in the same audit was fixed immediately by updating the lockfile to PostCSS 8.5.23 and Nano ID 3.3.16.

Acceptance Criteria

Confirm and document whether any deployed GovOPlaN route uses React Router RSC/action handling affected by the advisory.
Upgrade react-router/react-router-dom to a non-vulnerable release (currently indicated by npm as 8.3.0+) without forcing an unreviewed major update.
Update module peer ranges consistently across WebUI packages.
Run core typecheck/build, route tests, and all module permutations.
npm audit no longer reports GHSA-qwww-vcr4-c8h2.

Reference

https://github.com/advisories/GHSA-qwww-vcr4-c8h2

## Problem `npm audit` reports GHSA-qwww-vcr4-c8h2 against the installed React Router 7 release. The available automated remediation crosses into React Router 8, so it requires an intentional compatibility migration rather than `npm audit fix --force`. GovOPlaN currently uses client-side routing rather than React Server Components, which likely narrows immediate exposure, but the vulnerable production dependency must remain visible and be removed. The PostCSS GHSA-r28c-9q8g-f849 advisory found in the same audit was fixed immediately by updating the lockfile to PostCSS 8.5.23 and Nano ID 3.3.16. ## Acceptance Criteria - [ ] Confirm and document whether any deployed GovOPlaN route uses React Router RSC/action handling affected by the advisory. - [ ] Upgrade `react-router`/`react-router-dom` to a non-vulnerable release (currently indicated by npm as 8.3.0+) without forcing an unreviewed major update. - [ ] Update module peer ranges consistently across WebUI packages. - [ ] Run core typecheck/build, route tests, and all module permutations. - [ ] `npm audit` no longer reports GHSA-qwww-vcr4-c8h2. ## Reference - https://github.com/advisories/GHSA-qwww-vcr4-c8h2

zemion added the

type

debt

module/core area/webui codex/ready area/security

labels 2026-07-28 01:36:32 +02:00

zemion commented

2026-07-29 13:26:00 +02:00

Codex State: blocked

A fresh July 2026 audit reports zero vulnerabilities for Core runtime dependencies. The advisory remains in the all/dev lock analysis and in a Mail peer lock through React Router's RSC-related chain. GovOPlaN currently uses the client-side Vite router and does not expose React Server Components, so there is no identified reachable RSC endpoint.

The latest compatible upstream line available to the audit still carries the advisory. Keep this narrowly tracked and upgrade once a fixed release is available; do not suppress the advisory globally.

## Codex State: blocked A fresh July 2026 audit reports zero vulnerabilities for Core runtime dependencies. The advisory remains in the all/dev lock analysis and in a Mail peer lock through React Router's RSC-related chain. GovOPlaN currently uses the client-side Vite router and does not expose React Server Components, so there is no identified reachable RSC endpoint. The latest compatible upstream line available to the audit still carries the advisory. Keep this narrowly tracked and upgrade once a fixed release is available; do not suppress the advisory globally.

zemion added

and removed

labels 2026-07-29 13:26:01 +02:00

zemion commented

2026-07-30 22:32:20 +02:00

Codex State: progress

Summary

Confirmed GovOPlaN uses client-side routing and does not expose React Router RSC/action handlers covered by GHSA-qwww-vcr4-c8h2.
Migrated Core and every local WebUI module from react-router-dom to React Router 8.3's react-router entry point.
Harmonized module peer ranges with React 19.2.8, React Router 8.3, Vite 7.3.6, and the Node 22.22 runtime floor.
The current Core lockfile audit is clean; the full linked-module build and 31 module permutations pass.

Next / Blocked

package-lock.release.json still resolves released module tags whose package manifests advertise Router 7 peers. Coordinated module releases/tags and release-lock regeneration are required before this issue can close.

## Codex State: progress ### Summary - Confirmed GovOPlaN uses client-side routing and does not expose React Router RSC/action handlers covered by GHSA-qwww-vcr4-c8h2. - Migrated Core and every local WebUI module from `react-router-dom` to React Router 8.3's `react-router` entry point. - Harmonized module peer ranges with React 19.2.8, React Router 8.3, Vite 7.3.6, and the Node 22.22 runtime floor. - The current Core lockfile audit is clean; the full linked-module build and 31 module permutations pass. ### Next / Blocked - `package-lock.release.json` still resolves released module tags whose package manifests advertise Router 7 peers. Coordinated module releases/tags and release-lock regeneration are required before this issue can close.

zemion commented

2026-08-19 23:10:23 +02:00

The recorded release-lock blocker has now cleared, so this issue can close.

Current evidence:

Core pins react-router 8.3.0 and contains no react-router-dom installation in either package-lock.json or package-lock.release.json.
All 36 local WebUI package manifests that use routing declare the compatible peer range >=8.3.0 <9.
The v0.1.18 release lock now contains released GovOPlaN module packages with that same Router 8 peer range (13 routed packages represented in the release composition).
npm audit --omit=dev --package-lock-only reports zero vulnerabilities.
The full lock audit no longer reports GHSA-qwww-vcr4-c8h2; its one current finding is the separate Nano ID development-chain advisory GHSA-2v37-7h3g-55p8.
Core’s full TypeScript/Vite production build and bundle budget passed again today; the earlier migration state log records all module permutations passing.

The earlier source review remains valid: GovOPlaN uses the client-side Vite router and exposes no React Router RSC/action-handler deployment surface. No further code change was required in this pass because coordinated v0.1.18 releases and lock regeneration resolved the last blocker.

The recorded release-lock blocker has now cleared, so this issue can close. Current evidence: - Core pins `react-router` 8.3.0 and contains no `react-router-dom` installation in either `package-lock.json` or `package-lock.release.json`. - All 36 local WebUI package manifests that use routing declare the compatible peer range `>=8.3.0 <9`. - The v0.1.18 release lock now contains released GovOPlaN module packages with that same Router 8 peer range (13 routed packages represented in the release composition). - `npm audit --omit=dev --package-lock-only` reports zero vulnerabilities. - The full lock audit no longer reports GHSA-qwww-vcr4-c8h2; its one current finding is the separate Nano ID development-chain advisory GHSA-2v37-7h3g-55p8. - Core’s full TypeScript/Vite production build and bundle budget passed again today; the earlier migration state log records all module permutations passing. The earlier source review remains valid: GovOPlaN uses the client-side Vite router and exposes no React Router RSC/action-handler deployment surface. No further code change was required in this pass because coordinated v0.1.18 releases and lock regeneration resolved the last blocker.

zemion closed this issue

2026-08-19 23:10:24 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#269