Context
Dependabot/npm audit flags GHSA-qwww-vcr4-c8h2 on react-router-dom — a CSRF-adjacent advisory in React Router's RSC (React Server Components) mode.
Why it's not fixed yet
The advisory's fix requires react-router ≥ 8.3.0. This app depends on react-router-dom, which has no 8.x release — React Router folded the DOM bindings into the bare react-router package starting at v8. Upgrading means migrating off react-router-dom to react-router (package rename, not just a version bump), which is a real migration, not a patch bump.
Why it's likely low real-world risk here
This app only uses the client Data Router / library mode (RouterProvider, no SSR/framework mode, no RSC config) — the specific RSC-mode bypass this advisory describes may not even be reachable in this codebase. Worth confirming during triage rather than assuming.
Next steps
- When
react-router (the unified package) has a stable release path that fits this app's Data Router usage, migrate react-router-dom → react-router and drop this from the alert list.
- Until then:
security-engineer should periodically confirm the RSC-mode bypass genuinely doesn't apply to this app's routing setup (client Data Router only), so this stays a documented accepted risk rather than a silent one.
Originally flagged during the dependency-update pass in #67; previously tracked in a local .claude/backlog/roadmap.md file, which has since been removed in favor of GitHub Issues as the single source of truth for backlog items.
Context
Dependabot/npm audit flags
GHSA-qwww-vcr4-c8h2onreact-router-dom— a CSRF-adjacent advisory in React Router's RSC (React Server Components) mode.Why it's not fixed yet
The advisory's fix requires
react-router≥ 8.3.0. This app depends onreact-router-dom, which has no 8.x release — React Router folded the DOM bindings into the barereact-routerpackage starting at v8. Upgrading means migrating offreact-router-domtoreact-router(package rename, not just a version bump), which is a real migration, not a patch bump.Why it's likely low real-world risk here
This app only uses the client Data Router / library mode (
RouterProvider, no SSR/framework mode, no RSC config) — the specific RSC-mode bypass this advisory describes may not even be reachable in this codebase. Worth confirming during triage rather than assuming.Next steps
react-router(the unified package) has a stable release path that fits this app's Data Router usage, migratereact-router-dom→react-routerand drop this from the alert list.security-engineershould periodically confirm the RSC-mode bypass genuinely doesn't apply to this app's routing setup (client Data Router only), so this stays a documented accepted risk rather than a silent one.Originally flagged during the dependency-update pass in #67; previously tracked in a local
.claude/backlog/roadmap.mdfile, which has since been removed in favor of GitHub Issues as the single source of truth for backlog items.