Haozhe Wu
1e5b79dac6
React Router 7.12.0 through 8.2.x carry a high-severity RSC-mode CSRF bypass (GHSA-qwww-vcr4-c8h2). We were on 7.18.1, inside that range. The advisory is not reachable here — the app is a client-side SPA on createBrowserRouter with no @react-router/server and no RSC entry point, and the frontend ships as static Vite output — but 7.18.1 is the final 7.x release, no backport exists, and 8.3.0 is the only patched version, so staying put means staying on an EOL line with a permanent open alert. react-router-dom has no 8.x at all; the DOM exports moved into react-router itself. So the dependency is swapped and every import rewritten. All ten APIs in use here are unchanged in 8.3.0, and none of the data-layer surface that changed most between majors is used. react-router 8 requires Node >=22.22.0, which is the same wall that had jsdom 30 and @testing-library/jest-dom 7 sitting in the Dependabot ignore list. Node 20 reached EOL on 2026-04-30, so the toolchain moves to Node 22 across CI, the wiki workflow, the Dockerfile and docker-compose. That unblocks all three at once: jsdom and jest-dom are taken here too, and their ignores are removed rather than left carrying a rationale that no longer holds. Verified on the frontend suite: tsc -b and vite build clean, 310 tests across 35 files pass before and after the jsdom/jest-dom bumps.
59 lines
1.6 KiB
YAML
59 lines
1.6 KiB
YAML
name: Wiki
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "wiki/**"
|
|
- ".github/workflows/wiki.yml"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- "wiki/**"
|
|
- ".github/workflows/wiki.yml"
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: "22"
|
|
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Check JavaScript syntax
|
|
run: |
|
|
node --check wiki/main.js
|
|
node --check wiki/theme.js
|
|
node --check wiki/docs/content.js
|
|
node --check wiki/docs/main.js
|
|
|
|
- name: Check locale JSON
|
|
run: python -m json.tool wiki/locales/en.json >/dev/null
|
|
|
|
- name: Check social card metadata
|
|
run: python wiki/scripts/check_social_cards.py
|
|
|
|
- name: Check static site files
|
|
run: |
|
|
test -f wiki/index.html
|
|
test -f wiki/home/index.html
|
|
test -f wiki/docs/index.html
|
|
test -f wiki/tutorials/index.html
|
|
test -f wiki/alpha-library/index.html
|
|
test -f wiki/research-lab/index.html
|
|
test -f wiki/_redirects
|
|
test -f wiki/_headers
|
|
test -f wiki/assets/icon.png
|
|
test -f wiki/assets/alpha-library-og.png
|
|
blocked="localhost\\|nano"
|
|
blocked="${blocked}bot"
|
|
! grep -R "$blocked" wiki --exclude=README.md
|