fix: bump react-router and vitest to resolve Dependabot advisories#9215
Merged
Conversation
Resolves 6 open Dependabot alerts (all npm, manifest pnpm-lock.yaml): - react-router 7.12.0 -> 7.15.0 (fixes GHSA-8x6r-g9mw-2r78 [high], GHSA-49rj-9fvp-4h2h [high], GHSA-8646-j5j9-6r62 [high], GHSA-2j2x-hqr9-3h42 [medium], GHSA-f22v-gfqf-p8f3 [medium]) - vitest 4.0.x -> 4.1.x (fixes GHSA-5xrq-8626-4rwp [critical]) Aligned lockstep siblings to avoid peer-dependency mismatches: @react-router/dev|node|serve -> 7.15.0, @vitest/coverage-v8 -> ^4.1.0. Edited catalog entries in pnpm-workspace.yaml and regenerated pnpm-lock.yaml; verified with pnpm install --frozen-lockfile.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR updates four dependency pins in the pnpm workspace catalog: bumps for React Router packages to 7.15.0 and Vitest (+coverage plugin) to ^4.1.8. ChangesDependency Version Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the workspace dependency catalog and lockfile to remediate Dependabot advisories by bumping React Router and Vitest (and aligned companion packages) to non-vulnerable versions, keeping installs consistent via a regenerated pnpm-lock.yaml.
Changes:
- Bump
react-routerto7.15.0and align@react-router/*siblings to7.15.0in the workspace catalog. - Bump
vitestto the4.1.xline and align@vitest/coverage-v8accordingly in the workspace catalog. - Regenerate
pnpm-lock.yamlto reflect the updated catalog resolutions and dedupe to the intended versions.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
pnpm-workspace.yaml |
Updates catalog entries for react-router, @react-router/*, vitest, and @vitest/coverage-v8. |
pnpm-lock.yaml |
Regenerated lockfile capturing the new resolved versions and transitive dependency updates. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
prateekshourya29
approved these changes
Jun 4, 2026
The critical advisory GHSA-5xrq-8626-4rwp is patched in vitest 4.1.8, but the catalog specifiers were ^4.1.0, which permits resolving to vulnerable 4.1.0-4.1.7. Align the floor with the documented patched version for vitest and @vitest/coverage-v8 so a future lockfile refresh cannot reintroduce a vulnerable Vitest stack. Resolved version is unchanged (4.1.8).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolves all 6 open Dependabot alerts (all npm, manifest
pnpm-lock.yaml) by bumping the affected catalog entries inpnpm-workspace.yamland regenerating the lockfile.vitestreact-routerreact-routerreact-routerreact-routerreact-routerreact-router→7.15.0is the lowest version that clears all five react-router advisories. To avoid peer-dependency mismatches, the lockstep sibling packages were aligned in the same change:@react-router/dev/@react-router/node/@react-router/serve→7.15.0@vitest/coverage-v8→^4.1.0(resolves to4.1.8alongsidevitest)All bumps are within-major (minor) version changes — no breaking API changes expected.
Type of Change
Screenshots and Media (if applicable)
Test Scenarios
pnpm install --frozen-lockfilesucceeds (lockfile consistent with manifests) ✅ verifiedreact-router@7.15.0copy andvitest@4.1.8; noreact-router@7.1x (<7.15)orvitest@4.0.xcopies remain ✅ verifiedReferences
🤖 Generated with Claude Code
Summary by CodeRabbit