fix(ui): bump react-router-dom to patched 7.18.1

[nazarli-shabnam]

Summary

react-router-dom was pinned to resolve at 7.13.0, which npm audit flags high severity across the 7.0.0 - 7.15.0 range: a vendored turbo-stream deserialization RCE, an open redirect via //-prefixed paths, stored/reflected XSS (Location header, javascript: redirect targets, RSC redirects), a DoS via unbounded __manifest path expansion, a single-fetch reflected-input DoS, and a CSRF gap on PUT/PATCH/DELETE document requests.

Fixes #149

What changed

Ran npm audit fix in apps/web, which bumped the locked react-router/react-router-dom resolution to 7.18.1 (package.json's existing ^7.13.0 range already permitted this — only package-lock.json changed) and incidentally cleared the moderate postcss advisory the issue also mentioned. npm audit no longer flags either.

Scope discipline: left the other, unrelated vulnerabilities npm audit still lists (babel/core, brace-expansion, esbuild, form-data, js-yaml, linkify-it, markdown-it) untouched — out of scope for this issue.

Test plan

• npm audit — react-router/postcss no longer flagged (only an unrelated low-severity esbuild advisory remains)
• npm run typecheck && npm run lint && npm run build all pass
• Live manual smoke-test (Playwright against npm run dev + a real running API/Postgres via docker compose): existing session redirected correctly to workspace home, clicked through Projects → issue detail page (fully rendered, 0 console errors), tested browser back (2 steps) and forward navigation (both landed on the correct history entries), and confirmed an unknown route still falls through to the existing catch-all redirect with no crash. No regressions found from the 7.13 → 7.18 bump.

[strix-security]

Strix Security Review

No security issues found.

_{Updated for e26edaa.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• apps/web/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 302371c5-d6b3-49b8-8d35-02500db13e5d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 149-bump-react-router

---

_{Comment @coderabbitai help to get the list of available commands.}