Haozhe Wu
1e5b79dac6
React Router 7.12.0 through 8.2.x carry a high-severity RSC-mode CSRF bypass (GHSA-qwww-vcr4-c8h2). We were on 7.18.1, inside that range. The advisory is not reachable here — the app is a client-side SPA on createBrowserRouter with no @react-router/server and no RSC entry point, and the frontend ships as static Vite output — but 7.18.1 is the final 7.x release, no backport exists, and 8.3.0 is the only patched version, so staying put means staying on an EOL line with a permanent open alert. react-router-dom has no 8.x at all; the DOM exports moved into react-router itself. So the dependency is swapped and every import rewritten. All ten APIs in use here are unchanged in 8.3.0, and none of the data-layer surface that changed most between majors is used. react-router 8 requires Node >=22.22.0, which is the same wall that had jsdom 30 and @testing-library/jest-dom 7 sitting in the Dependabot ignore list. Node 20 reached EOL on 2026-04-30, so the toolchain moves to Node 22 across CI, the wiki workflow, the Dockerfile and docker-compose. That unblocks all three at once: jsdom and jest-dom are taken here too, and their ignores are removed rather than left carrying a rationale that no longer holds. Verified on the frontend suite: tsc -b and vite build clean, 310 tests across 35 files pass before and after the jsdom/jest-dom bumps.
55 lines
1.5 KiB
JSON
55 lines
1.5 KiB
JSON
{
|
|
"name": "vibe-trading-frontend",
|
|
"private": true,
|
|
"version": "0.1.12",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build",
|
|
"preview": "vite preview",
|
|
"test": "vitest",
|
|
"test:run": "vitest run",
|
|
"test:coverage": "vitest run --coverage"
|
|
},
|
|
"dependencies": {
|
|
"@fontsource/inter": "^5.3.0",
|
|
"@fontsource/jetbrains-mono": "^5.3.0",
|
|
"clsx": "^2.1.0",
|
|
"echarts": "^6.1.0",
|
|
"highlight.js": "^11.11.1",
|
|
"i18next": "^26.3.6",
|
|
"i18next-browser-languagedetector": "^8.2.1",
|
|
"katex": "^0.18.1",
|
|
"lucide-react": "^1.27.0",
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"react-i18next": "^17.0.11",
|
|
"react-markdown": "^9.0.0",
|
|
"react-router": "^8.3.0",
|
|
"rehype-highlight": "^7.0.0",
|
|
"rehype-katex": "^7.0.1",
|
|
"remark-gfm": "^4.0.1",
|
|
"remark-math": "^6.0.0",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "^3.6.0",
|
|
"zustand": "^5.0.14"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/typography": "^0.5.20",
|
|
"@testing-library/jest-dom": "^7.0.0",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@vitejs/plugin-react": "^4.3.0",
|
|
"@vitest/coverage-v8": "^4.1.10",
|
|
"autoprefixer": "^10.5.4",
|
|
"jsdom": "^30.0.0",
|
|
"postcss": "^8.5.23",
|
|
"tailwindcss": "^3.4.0",
|
|
"typescript": "^5.7.0",
|
|
"vite": "^6.4.3",
|
|
"vitest": "^4.1.0"
|
|
}
|
|
}
|