build(deps): bump dependabot dependencies by JeanMarcMilletScality · Pull Request #1176 · scality/core-ui

JeanMarcMilletScality · 2026-07-28T17:12:15Z

TL;DR

Consolidates the pending dependabot dependency bumps into one PR, plus the advisories that were published while those PRs sat open. Takes npm audit from 9 root advisories on development/1.0 down to 2, both of which have no in-range fix (details at the bottom).

Context

Dependabot opened these as individual PRs, but none can merge: the claude-review check fails on every dependabot PR because repository secrets aren't exposed to the dependabot Actions context. This PR ships the same bumps from a normal branch instead. (The CI gate itself is tracked for a separate fix.)

Changes

Dependency	From → To	Kind	Why
`react-router`	7.13.0 → 7.18.1	direct (ships)	4 high advisories — see Approach
`react-router-dom`	7.13.0 → 7.18.1	direct (ships)	kept in lockstep with `react-router` — see Approach
`@babel/core`	7.28.6 → 7.29.7	dev	source-map bug fixes
`esbuild`	0.25.12 → 0.28.1	transitive	security: dev-server path traversal, Deno integrity
`markdown-it`	14.1.1 → 14.3.0	transitive	security/perf + CommonMark fixes
`linkify-it`	5.0.0 → 5.0.2	transitive	security: fuzzy-link ReDoS
`ws`	8.20.1 → 8.21.1	transitive	security: remote memory-exhaustion DoS
`postcss`	8.5.15 → 8.5.24	transitive	security: path traversal in source-map auto-loading
`fast-uri`	3.1.2 → 3.1.4	transitive	security: host confusion via backslash authority delimiter + failed IDN canonicalization
`js-yaml`	4.1.1 → 4.3.0, 3.14.2 → 3.15.0	transitive	security: quadratic-complexity DoS via merge-key chains
`brace-expansion`	nested copies → 1.1.16 / 2.1.3 / 5.0.8	transitive	security: exponential-expansion DoS

Approach

Why react-router-dom moves with react-router. Dependabot's PR bumped only react-router. But react-router-dom@7.13.0 hard-pins react-router@7.13.0, so bumping react-router alone leaves a second, nested copy of react-router in the tree — two separate Router contexts, which breaks useNavigate/useLocation for consumers whose provider comes from the other copy.

Before — react-router bumped alone (dependabot #1131):

node_modules/react-router                                 7.18.1
node_modules/react-router-dom                             7.13.0
node_modules/react-router-dom/node_modules/react-router   7.13.0   // ← duplicate: 2nd Router context

After — pair bumped together (this PR):

node_modules/react-router       7.18.1
node_modules/react-router-dom   7.18.1   // ← in lockstep; single react-router copy

Verified the built lockfile contains exactly one node_modules/react-router entry.

Why 7.18.1 and not 8.3.0. Dependabot #1174 proposes react-router@8.3.0. That isn't viable here:

react-router@8.3.0 declares peers react >=19.2.7, but core-ui's peerDependencies still allow react ^18.0.0. Taking it would silently drop React 18 support for every consumer.
react-router-dom has no 8.x release at all — it stops at 7.18.1. So bumping react-router to 8 recreates exactly the duplicate-Router-context problem described above.

7.18.1 is a minor bump that clears 4 of the 5 open react-router advisories (open redirect via backslash in <Link>/useNavigate, RSCErrorHandler missing protocol validation, arbitrary constructor injection in deserializeErrors(), unauthenticated DoS via inefficient route matching — all fixed in 7.18.0).

Review focus

🟡 package.json › react-router + react-router-dom — both pinned to exactly 7.18.1; confirm they stay aligned (this is the shipped runtime dep). core-ui imports only MemoryRouter, BrowserRouter, useLocation, useNavigate — all unchanged across 7.x.
⚪ package-lock.json — changes are scoped to the deps above plus their @babel/* / @esbuild/* sub-packages; no unrelated churn.

How to test

npm ci
npm test        # 513 tests / 43 suites pass
npm run build   # tsc, exit 0

Known remaining advisories (both unfixable in range)

npm audit still reports two root advisories. Neither has a fix that fits this PR — noting them so they aren't mistaken for oversights. (The raw npm audit count looks much larger because npm lists every dependent of a vulnerable package as its own line.)

react-router — RSC mode CSRF bypass (>=7.12.0 <8.3.0). Fixed only in 8.3.0, which is React-19-only per above. Does not apply: core-ui does not use RSC mode.
brace-expansion — unbounded-expansion OOM DoS (<=5.0.7). Every copy in the tree is already at the latest release of its line (1.1.16, 2.1.3, 5.0.8), but the advisory range is a flat <=5.0.7 with no 1.x/2.x backport, so the 1.x and 2.x copies stay flagged. Reachable only from dev tooling (eslint, glob, jest, storybook, copyfiles) and never shipped in dist. Clearing it needs eslint 8→10 plus glob/jest majors — out of scope for a security sweep.

References

Supersedes these dependabot PRs (can be closed once this merges):

build(deps): bump react-router from 7.13.0 to 7.15.1 #1131 — bump react-router 7.13.0 → 7.15.1
chore(deps-dev): bump @babel/core from 7.28.6 to 7.29.6 #1134 — bump @babel/core 7.28.6 → 7.29.6 (dev)
build(deps): bump markdown-it from 14.1.1 to 14.2.0 #1136 — bump markdown-it 14.1.1 → 14.2.0
build(deps): bump esbuild from 0.25.12 to 0.28.1 #1145 — bump esbuild 0.25.12 → 0.28.1
build(deps): bump linkify-it from 5.0.0 to 5.0.1 #1149 — bump linkify-it 5.0.0 → 5.0.1
chore(deps): bump ws from 8.20.1 to 8.21.1 #1154 — bump ws 8.20.1 → 8.21.1
chore(deps): bump linkify-it from 5.0.0 to 5.0.2 #1166 — bump linkify-it 5.0.0 → 5.0.2
chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 #1167 — bump fast-uri 3.1.2 → 3.1.4
chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 #1175 — bump postcss 8.5.15 → 8.5.23

Should be closed as not viable rather than superseded:

chore(deps): bump react-router from 7.13.0 to 8.3.0 #1174 — bump react-router 7.13.0 → 8.3.0 (React-19-only peer; no matching react-router-dom 8.x)

Replaces #1157, which was opened from a branch with an invalid build/ prefix.

🤖 Generated with Claude Code

Ships the pending dependabot bumps in a single PR, since the individual dependabot PRs cannot merge (the claude-review check fails on dependabot PRs because repository secrets are not exposed to that context). Direct: - react-router 7.13.0 -> 7.15.1 - react-router-dom 7.13.0 -> 7.15.1 (kept in lockstep with react-router to avoid a duplicate/mismatched react-router copy and split Router context) Transitive / dev (resolved to latest compatible, >= dependabot proposals): - @babel/core 7.28.6 -> 7.29.7 (security/bug fixes; dev only) - esbuild 0.25.12 -> 0.28.1 (security: dev-server path traversal, Deno integrity) - markdown-it 14.1.1 -> 14.3.0 (security/perf; CommonMark fixes) - linkify-it 5.0.0 -> 5.0.2 (security: fuzzy-link ReDoS) - ws 8.20.1 -> 8.21.1 (security: remote memory-exhaustion DoS) All 513 tests pass and tsc build succeeds. Vulnerability count 5 -> 1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bert-e · 2026-07-28T17:12:18Z

Hello jeanmarcmilletscality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request `TBA`
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2026-07-28T17:12:25Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

Advisories published after the first commit on this branch left 6 open vulnerabilities. Clears all of them that have a fix within the existing ranges. Direct: - react-router 7.15.1 -> 7.18.1 - react-router-dom 7.15.1 -> 7.18.1 (kept in lockstep, as before) Clears 4 high advisories: open redirect via backslash in Link and useNavigate, RSCErrorHandler missing protocol validation (XSS), arbitrary constructor injection in deserializeErrors(), and unauthenticated DoS via inefficient route matching. All fixed in 7.18.0. core-ui uses only MemoryRouter/BrowserRouter/useLocation/ useNavigate, unchanged across 7.x. Not taking react-router 8.3.0 (dependabot #1174): it peers on react >=19.2.7 while core-ui still supports react ^18, and react-router-dom has no 8.x release, so bumping react-router alone would reintroduce the duplicate-Router-context problem this branch fixes. The one remaining react-router advisory (RSC mode CSRF bypass, fixed only in 8.3.0) does not apply - core-ui does not use RSC mode. Transitive: - postcss 8.5.15 -> 8.5.24 (path traversal in source-map auto-loading) - fast-uri 3.1.2 -> 3.1.4 (host confusion via backslash authority delimiter and failed IDN canonicalization) - js-yaml 4.1.1 -> 4.3.0, 3.14.2 -> 3.15.0 (quadratic-complexity DoS via YAML merge-key chains) - brace-expansion nested copies -> latest in each line (1.1.16, 2.1.3, 5.0.8), clearing the exponential-expansion DoS advisories brace-expansion still reports one advisory whose range is <=5.0.7 with no 1.x/2.x backport, so the 1.1.16 and 2.1.3 copies stay flagged. It is reachable only from dev tooling (eslint, glob, jest, storybook, copyfiles) and never ships in dist; clearing it needs eslint 8->10, glob and jest majors, which is out of scope here. All 513 tests pass and tsc build succeeds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bert-e · 2026-07-28T17:32:40Z

Conflict

There is a conflict between your branch improvement/dependabot-dependency-bumps and the
destination branch development/1.0.

Please resolve the conflict on the feature branch (improvement/dependabot-dependency-bumps).

git fetch && \
git checkout origin/improvement/dependabot-dependency-bumps && \
git merge origin/development/1.0

Resolve merge conflicts and commit

git push origin HEAD:improvement/dependabot-dependency-bumps

…t/dependabot-dependency-bumps Conflict was in package-lock.json only; package.json auto-merged (base's 0.226.0 version bump and valalint removal alongside this branch's react-router pins). Resolved by taking development/1.0's lockfile wholesale and re-applying this branch's bumps through npm, rather than hand-merging lockfile hunks: git checkout origin/development/1.0 -- package-lock.json npm install npm update @babel/core esbuild markdown-it linkify-it ws postcss \ fast-uri js-yaml brace-expansion nanoid This keeps the base's own lockfile changes intact (including the @typescript-eslint/parser and rule-tester removals that came with dropping valalint). Verified the result changes exactly the same 66 package versions relative to the new base as it did before the merge, with no packages added or removed. All 43 suites / 428 tests pass, tsc build exits 0, lint clean. The test count differs from the pre-merge 513 because development/1.0 deleted the three valalint rule-tester suites and added three component suites; the test files at this commit are identical to the base's. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bert-e · 2026-07-28T17:57:45Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

damiengillesscality

Please handle the bump in the other applications and share with the team the info

bert-e · 2026-07-29T09:21:12Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

JeanMarcMilletScality · 2026-07-29T09:38:58Z

/approve

bert-e · 2026-07-29T09:39:05Z

Build failed

The build for commit did not succeed in branch improvement/dependabot-dependency-bumps

The following options are set: approve

JeanMarcMilletScality · 2026-07-29T12:46:49Z

/bypass_build_status

bert-e · 2026-07-29T12:46:54Z

Not authorized

I'm afraid I cannot do that, @JeanMarcMilletScality:

/bypass_build_status

You don't have enough credentials to use bypass_build_status.

Please edit or delete the corresponding comment so I can move on.

The following options are set: approve

JeanMarcMilletScality mentioned this pull request Jul 28, 2026

build(deps): bump dependabot dependencies #1157

Closed

damiengillesscality approved these changes Jul 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump dependabot dependencies - #1176

build(deps): bump dependabot dependencies#1176
JeanMarcMilletScality wants to merge 3 commits into
development/1.0from
improvement/dependabot-dependency-bumps

JeanMarcMilletScality commented Jul 28, 2026 •

edited

Loading

Uh oh!

bert-e commented Jul 28, 2026

Uh oh!

bert-e commented Jul 28, 2026

Uh oh!

bert-e commented Jul 28, 2026

Uh oh!

bert-e commented Jul 28, 2026

Uh oh!

damiengillesscality left a comment

Uh oh!

bert-e commented Jul 29, 2026

Uh oh!

JeanMarcMilletScality commented Jul 29, 2026

Uh oh!

bert-e commented Jul 29, 2026

Uh oh!

JeanMarcMilletScality commented Jul 29, 2026

Uh oh!

bert-e commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

JeanMarcMilletScality commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TL;DR

Context

Changes

Approach

Review focus

How to test

Known remaining advisories (both unfixable in range)

References

Uh oh!

bert-e commented Jul 28, 2026

Hello jeanmarcmilletscality,

Uh oh!

bert-e commented Jul 28, 2026

Waiting for approval

Uh oh!

bert-e commented Jul 28, 2026

Conflict

Uh oh!

bert-e commented Jul 28, 2026

Waiting for approval

Uh oh!

damiengillesscality left a comment

Choose a reason for hiding this comment

Uh oh!

bert-e commented Jul 29, 2026

Waiting for approval

Uh oh!

JeanMarcMilletScality commented Jul 29, 2026

Uh oh!

bert-e commented Jul 29, 2026

Build failed

Uh oh!

JeanMarcMilletScality commented Jul 29, 2026

Uh oh!

bert-e commented Jul 29, 2026

Not authorized

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

JeanMarcMilletScality commented Jul 28, 2026 •

edited

Loading