chore: resolve open Dependabot alerts - #119
Conversation
Bump the vulnerable dependencies GitHub flagged on the lockfile and the example and test manifests: - react-router 7.18.1 -> 7.18.3 and 8.1.0 -> 8.3.1 (RSC CSRF bypass, GHSA-qwww-vcr4-c8h2), with the matching @react-router/* dev tooling - serialize-javascript 6 -> 7.1.1 in the corpus and react-router-8 example - @faker-js/faker 10.5.0 and morgan 1.11.0 in the epic-stack examples - pnpm overrides for transitive fast-uri, js-yaml, undici, brace-expansion, socket.io-parser, ip-address, adm-zip, sharp, svgo, shell-quote, postcss, browserslist, and @remix-run/router, pinned to their patched patch or minor releases within the same major The plugin's own dependency and peer ranges are unchanged and still cover React Router 7 and 8. React Router 8.3 adds a required `future.unstable_enableNodeReadableStream` flag to its resolved config, so the plugin now resolves it (default false) and passes it through to presets and buildEnd; the plugin ships its own server entry, so behavior is unchanged. The RSC preview fixture drops a `@ts-expect-error` that 8.3's typings made unnecessary. react-router-dom 6.30.4 (GHSA-jjmj-jmhj-qwj2) stays: it is pulled in by @nasa-gcn/remix-seo in the epic-stack example and has no patched release. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
commit: |
Benchmark results
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7ed03f25cd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }>; | ||
|
|
||
| const createDefaultFutureConfig = (): FutureConfig => ({ | ||
| unstable_enableNodeReadableStream: false, |
There was a problem hiding this comment.
When neither the user nor a preset explicitly sets this flag, src/index.ts lines 475–478 replaces the fully resolved future object with userAndPresetConfig.future ?? {} before invoking buildEnd. Consequently, React Router 8.3 buildEnd hooks receive unstable_enableNodeReadableStream as undefined rather than the required default false, despite the changeset promising a resolved config matching the current shape. Pass the resolved future object through, or add this default when constructing buildEndReactRouterConfig.
Useful? React with 👍 / 👎.
Merging this PR will not alter performance
Comparing 
Footnotes
|
The `reveal --no-typescript` help line now carries a deprecation note. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 participant
Summary
Resolves the open Dependabot alerts. The notable one is React Router's RSC mode CSRF bypass (GHSA-qwww-vcr4-c8h2), fixed in 7.18.2 and 8.3.0; the lockfile moves to 7.18.3 and 8.3.1, and the test fixtures and examples follow.
@react-router/*tooling in the root dev dependencies, corpus fixtures, and examplesserialize-javascript7.1.1,@faker-js/faker10.5.0,morgan1.11.0 where declared directlyfast-uri,js-yaml,undici,brace-expansion,socket.io-parser,ip-address,adm-zip,sharp,svgo,shell-quote,postcss,browserslist, and@remix-run/router, each pinned to its patched release within the same majorThe plugin's published dependency and peer ranges are unchanged (
^7.13.0 || ^8.0.0). React Router 8.3 adds a requiredfuture.unstable_enableNodeReadableStreamto its resolved config type, so the plugin resolves it with afalsedefault and passes it through to presets andbuildEnd. Behavior is unchanged because the plugin ships its own server entry. A patch changeset is included for that.Left open:
react-router-dom6.30.4 has no patched release and comes from@nasa-gcn/remix-seoin the epic-stack example.Verification
pnpm typecheck,pnpm build,pnpm exec rstest run(all files pass)rsc-test,rsc-nojs-test,hmr-hdr-rsc-test,fog-of-war-test,prerender-test,route-exports-modified-offscreen-test: 115 passed🤖 Generated with Claude Code