DEP-001 frontend advisory remediation

Updated: 2026-08-10

Status: VERIFIED LOCALLY. Remote run 608 confirms the dependency-audit step passes; the pull-request job then failed on an unrelated stale Career Workspace smoke assertion. Live deployment still requires merge-to-main and production verification.

Trigger

The live deployment pipeline failed its frontend dependency audit on five advisories: React Router/@remix-run/router, js-yaml and nanoid.

Resolution

Upgraded react-router-dom from the vulnerable 6.x line to 7.18.2, covering the subsequently reported React Router advisories.
Refreshed transitive js-yaml from 3.15.0 to 3.15.1 and nanoid from 3.3.16 to 3.3.18 through normal lockfile resolution.
Removed the obsolete v6 RouterProvider future flag. Existing route definitions and URLs were not redesigned.
Supplied Node's TextEncoder/TextDecoder to Jest's jsdom environment for React Router v7 module initialization.
Did not run npm audit fix --force; the explicit upgrade and resolved lockfile were reviewed.

Verification

npm.cmd audit: PASS, zero vulnerabilities.
Focused data-router regression: 6 suites, 24 tests passed.
Full frontend regression: 49 suites, 190 tests passed.
npm.cmd run build: PASS, production compilation, TypeScript and static generation.
Resolved versions: react-router-dom/react-router 7.18.2, js-yaml 3.15.1, nanoid 3.3.18.
Commit: b55a592 (pushed to release-readiness).
Gitea pull-request run 608: Audit frontend dependencies PASS; the job advanced through frontend tests and failed later at Test browser smoke flows because e2e/smoke.spec.ts still expected intentionally removed page copy.
Corrected smoke assertion: full local Playwright suite 4/4 passed against disposable local API/frontend data.

Remaining gate

Confirm a new pull-request run passes end to end, then merge/deploy from main and run production route smoke. No production access or deployment was performed in this session.

Rollback

Reverting b55a592 restores the previous router/test setup but also restores known vulnerable packages and the deployment-blocking audit result. Prefer fixing any v7 compatibility regression forward; do not suppress the audit without a reviewed exception.

2.3 KiB Raw Blame History