# DEP-001 frontend advisory remediation

Updated: 2026-08-10

Status: `VERIFIED LOCALLY`. Remote pull-request run 609 passes the complete CI job, including dependency audit and browser smoke. Live deployment still requires an approved merge-to-main and production verification.

## Trigger

The live deployment pipeline failed its frontend dependency audit on five advisories: React Router/@remix-run/router, js-yaml and nanoid.

## Resolution

- Upgraded `react-router-dom` from the vulnerable 6.x line to `7.18.2`, covering the subsequently reported React Router advisories.
- Refreshed transitive `js-yaml` from `3.15.0` to `3.15.1` and `nanoid` from `3.3.16` to `3.3.18` through normal lockfile resolution.
- Removed the obsolete v6 `RouterProvider` future flag. Existing route definitions and URLs were not redesigned.
- Supplied Node's `TextEncoder`/`TextDecoder` to Jest's jsdom environment for React Router v7 module initialization.
- Did not run `npm audit fix --force`; the explicit upgrade and resolved lockfile were reviewed.

## Verification

- `npm.cmd audit`: PASS, zero vulnerabilities.
- Focused data-router regression: 6 suites, 24 tests passed.
- Full frontend regression: 49 suites, 190 tests passed.
- `npm.cmd run build`: PASS, production compilation, TypeScript and static generation.
- Resolved versions: `react-router-dom`/`react-router` `7.18.2`, `js-yaml` `3.15.1`, `nanoid` `3.3.18`.
- Commit: `b55a592` (pushed to `release-readiness`).
- Gitea pull-request run 608: `Audit frontend dependencies` PASS; the job advanced through frontend tests and failed later at `Test browser smoke flows` because `e2e/smoke.spec.ts` still expected intentionally removed page copy.
- Corrected smoke assertion: full local Playwright suite 4/4 passed against disposable local API/frontend data.
- Smoke correction commit: `75bf144` (pushed to `release-readiness`).
- Gitea replacement run 609: complete pull-request test job PASS in 4m20s. The deploy job was skipped by its intentional `push`/`main` condition.

## Remaining gate

Merge only when the full release-readiness branch is approved, then observe the `main` deploy and run production route smoke. No production access or deployment was performed in this session.

## Rollback

Reverting `b55a592` restores the previous router/test setup but also restores known vulnerable packages and the deployment-blocking audit result. Prefer fixing any v7 compatibility regression forward; do not suppress the audit without a reviewed exception.