DEP-001 frontend advisory remediation

Updated: 2026-08-10

Status: VERIFIED LOCALLY. Remote pull-request run 609 passes the complete CI job, including dependency audit and browser smoke. Live deployment still requires an approved merge-to-main and production verification.

Trigger

The live deployment pipeline failed its frontend dependency audit on five advisories: React Router/@remix-run/router, js-yaml and nanoid.

Resolution

Upgraded react-router-dom from the vulnerable 6.x line to 7.18.2, covering the subsequently reported React Router advisories.
Refreshed transitive js-yaml from 3.15.0 to 3.15.1 and nanoid from 3.3.16 to 3.3.18 through normal lockfile resolution.
Removed the obsolete v6 RouterProvider future flag. Existing route definitions and URLs were not redesigned.
Supplied Node's TextEncoder/TextDecoder to Jest's jsdom environment for React Router v7 module initialization.
Did not run npm audit fix --force; the explicit upgrade and resolved lockfile were reviewed.

Verification

npm.cmd audit: PASS, zero vulnerabilities.
Focused data-router regression: 6 suites, 24 tests passed.
Full frontend regression: 49 suites, 190 tests passed.
npm.cmd run build: PASS, production compilation, TypeScript and static generation.
Resolved versions: react-router-dom/react-router 7.18.2, js-yaml 3.15.1, nanoid 3.3.18.
Commit: b55a592 (pushed to release-readiness).
Gitea pull-request run 608: Audit frontend dependencies PASS; the job advanced through frontend tests and failed later at Test browser smoke flows because e2e/smoke.spec.ts still expected intentionally removed page copy.
Corrected smoke assertion: full local Playwright suite 4/4 passed against disposable local API/frontend data.
Smoke correction commit: 75bf144 (pushed to release-readiness).
Gitea replacement run 609: complete pull-request test job PASS in 4m20s. The deploy job was skipped by its intentional push/main condition.

Remaining gate

Merge only when the full release-readiness branch is approved, then observe the main deploy and run production route smoke. No production access or deployment was performed in this session.

Rollback

Reverting b55a592 restores the previous router/test setup but also restores known vulnerable packages and the deployment-blocking audit result. Prefer fixing any v7 compatibility regression forward; do not suppress the audit without a reviewed exception.

2.4 KiB Raw Blame History