Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Remove react-router audit allowlist entry once upstream ships a fix

Open
  • Is something wrong?
#348 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
15/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Quiet
Tech stack
nodejs, react
Domain
frontend, security

Research direction

The allowlist entry for GHSA-qwww-vcr4-c8h2 lives in the ALLOWLIST in scripts/audit-check.cjs, and the accepted-risk bullet is in CLAUDE.md. Nothing can be done until npm lists react-router-dom outside the advisory range, so first check the registry and ui/package.json. Done means the dependency is bumped in ui/package.json and ui/package-lock.json, the allowlist entry and CLAUDE.md bullet are removed, and node ../scripts/audit-check.cjs passes from ui/.

Written by the indexing model from the issue text.

Description

tech-debt

Background

The CI dependency-vulnerability gate (scripts/audit-check.cjs, added in #347) allowlists one high-severity advisory:

  • GHSA-qwww-vcr4-c8h2 — React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response (react-router 7.12.0 – 8.2.0)
Why it's allowlisted (not fixed)
  • Non-applicable to this app. The UI is a client-only SPA using BrowserRouter; it never enables React Router's RSC / server-action mode, so the vulnerable code path is unreachable.
  • No fixed version exists (yet). [email protected] is latest and still inside the advisory range. npm's only offered "fix" is a semver-major downgrade to 7.11.0 (a feature regression, not a real fix).

This is the one high-severity accepted risk and the reason the audit gate is a small script rather than a bare npm audit --audit-level=high (which can't accept a single advisory). It's documented under "Accepted / deferred security risks" in CLAUDE.md.

Action to take when upstream patches

Once a patched react-router-dom is released (a version outside the advisory range, e.g. > 8.2.0 or a backported 7.x):

  1. Bump react-router-dom in ui/package.json and refresh ui/package-lock.json.
  2. Remove the GHSA-qwww-vcr4-c8h2 entry from the ALLOWLIST in scripts/audit-check.cjs.
  3. Remove the corresponding bullet from the "Accepted / deferred security risks" section of CLAUDE.md.
  4. Confirm node ../scripts/audit-check.cjs still passes from ui/ (and that the gate now finds nothing to accept for react-router).

References

Dominant language
TypeScript
Stars
0
Forks
0
Avg merge
8m
Merged PRs (30d)
8

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from LeeAdcock/robocodeJs.com

All issues in LeeAdcock/robocodeJs.com

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.