From 2ba1005426b41ab38a1424723367f97efaa621af Mon Sep 17 00:00:00 2001 From: Evan Vetere Date: Fri, 2 Oct 2026 23:29:45 -0400 Subject: [PATCH] fix: Bump react-router to 7.18.4 in the consumer UI The consumer portal plugin pinned react-router 7.18.0, inside the range affected by GHSA-qwww-vcr4-c8h2 (>=7.12.0 <7.18.2). Move to 7.18.4, the latest 7.x, which includes the fix. Key changes: - Pin react-router to 7.18.4 in package.json, matching the existing exact-pin style - Refresh bun.lock for that single package; no other dependency moves --- ui/consumer/bun.lock | 4 ++-- ui/consumer/package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ui/consumer/bun.lock b/ui/consumer/bun.lock index 516beec9..23e1252b 100644 --- a/ui/consumer/bun.lock +++ b/ui/consumer/bun.lock @@ -15,7 +15,7 @@ "react-day-picker": "^10", "react-dom": "19.2.8", "react-number-format": "^5.4.5", - "react-router": "7.18.0", + "react-router": "7.18.4", "sonner": "^2.0.7", "zod": "^4.4.3", }, @@ -586,7 +586,7 @@ "react-remove-scroll-bar": ["react-remove-scroll-bar@2.3.8", "", { "dependencies": { "react-style-singleton": "^2.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react"] }, "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q=="], - "react-router": ["react-router@7.18.0", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-pTTGt8J+ji1NOmYnjzT+bAJy/1zD+Jp4ziO6cL7T3ZLvXKtusO7BpFqlRXitqpcPVqllsIXFHRMt+2/k3Xn6HQ=="], + "react-router": ["react-router@7.18.4", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-PUPQcMhMGRAslLcvtlPz/kmzBEWPhLdgLFrL7pLNepBL6dX0lWj4WD2cUYVgYCuT3jxvghYFg81cDTj44DhetQ=="], "react-style-singleton": ["react-style-singleton@2.2.3", "", { "dependencies": { "get-nonce": "^1.0.0", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ=="], diff --git a/ui/consumer/package.json b/ui/consumer/package.json index 7048db0b..e588dbed 100644 --- a/ui/consumer/package.json +++ b/ui/consumer/package.json @@ -23,7 +23,7 @@ "react-day-picker": "^10", "react-dom": "19.2.8", "react-number-format": "^5.4.5", - "react-router": "7.18.0", + "react-router": "7.18.4", "sonner": "^2.0.7", "zod": "^4.4.3" },