fix(deps): remediate PROD-5108 security findings

[plural-copilot]

PROD-5108

Remediates the feasible non-critical dependency findings across Console assets, Go modules, and Mix dependencies.

Remediated outcomes

• React Router: migrated react-router-dom and resolved react-router from 6.30.4 to 7.13.0 for CVE-2026-53669, CVE-2026-53666, and CVE-2026-53668. Updated Sentry routing instrumentation to its React Router v7 helpers.
• Yarn transitive resolutions:
  • undici 7.29.0 for CVE-2026-15157, CVE-2026-16729, CVE-2026-14643, CVE-2026-13697, and CVE-2026-16728.
  • ip-address 10.2.2 for CVE-2026-69198 and CVE-2026-54272.
  • brace-expansion 2.1.4 and 5.0.9 for CVE-2026-14257 and CVE-2026-69152.
  • tar 7.5.21 and postcss 8.5.23.
• Go: github.com/google/cel-go is v0.29.0 in go/tools, go/deployment-operator, go/datastore, and go/controller.
• Mix: req is 0.6.3 (with Finch 0.23.0); feasible Gun/Cowlib updates resolve gun 2.5.0 and cowlib 2.19.0.

Unavoidable exceptions

• Gun target: Hex has no published gun release >= 2.16.0; its latest published release is 2.5.0. The lockfile uses 2.5.0, but the requested semver floor cannot be met as stated.
• Hackney target: hackney >= 4.0.1 cannot resolve with the intentionally pinned phoenix_swoosh ~> 0.3.4; Mix reports that Phoenix Swoosh 0.3.x requires hackney ~> 1.9. Upgrading that dependency chain would be a larger compatibility change, so Hackney remains 1.25.0.

Validation

Local unit tests were not run per request; CI is expected to validate.

Non-test commands run included:

• Yarn lockfile update and immutable install, followed by yarn rebuild esbuild, yarn design-system:build, yarn build:no-ds, and yarn why inspection for all requested JavaScript packages.
• go get github.com/google/cel-go@v0.29.0, go mod tidy, go mod verify, and go list -m in each affected Go module.
• mix deps.update req, Gun/Cowlib lockfile resolution, and mix deps.get.
• Final resolution assertions and git diff --check.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Implement Linear PROD-5108 in exactly one PR. The user explicitly requested no local unit tests; do not run unit tests. CI will validate....
🔗 Run history	View run history

[soffi-ai]

Soffi AI Summary

This PR remediates a set of security vulnerabilities (PROD-5108) across the frontend JavaScript/TypeScript dependencies, Go modules, and Elixir Mix dependencies. The motivation is to address feasible non-critical CVEs identified in a security audit, while documenting the unavoidable exceptions where upstream constraints prevent full remediation.

JavaScript/Frontend: The most impactful change is migrating from React Router v6 to React Router v7 (react-router-dom and react-router → 7.13.0), which resolves three CVEs (CVE-2026-53669, CVE-2026-53666, CVE-2026-53668). This required updating Sentry's routing instrumentation to the React Router v7 API. Yarn resolution overrides were also added to pin safe versions of transitive dependencies: undici (5 CVEs), ip-address (2 CVEs), brace-expansion (2 CVEs), tar, and postcss.

Go modules: github.com/google/cel-go was bumped to v0.29.0 across go/tools, go/deployment-operator, go/datastore, and go/controller to address a security finding in that library.

Elixir/Mix: req was updated to 0.6.3 (pulling in Finch 0.23.0), and gun was bumped to 2.5.0 alongside cowlib 2.19.0 to satisfy the updated dependency constraints. Hackney remains at 1.25.0 (blocked by phoenix_swoosh ~> 0.3.4 pinning hackney ~> 1.9), and gun >= 2.16.0 cannot be satisfied as no such Hex release exists — both are documented as unavoidable exceptions.

Commits

Commit	Summary
5667ac3	Remediates PROD-5108 security findings across all layers: migrates React Router from v6 to v7 (fixing 3 CVEs) with corresponding Sentry instrumentation updates, pins vulnerable transitive JS dependencies via Yarn resolutions (undici, ip-address, brace-expansion, tar, postcss), upgrades cel-go to v0.29.0 in four Go modules, and bumps Elixir's gun/cowlib/finch/req to their latest safe versions.

Deploy in Soffi

---

Updated: 2026-08-04 19:14 UTC

[linear]

PROD-5108

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-router-dom@​6.30.4 ⏵ 7.13.0	+3	+2	-9

View full report

[greptile-apps]

Greptile Summary

The PR remediates dependency findings across the frontend, Go modules, and Elixir application while updating Sentry to React Router v7 instrumentation.

• Upgrades React Router and several security-sensitive Yarn transitive dependencies.
• Aligns cel-go across four independently built Go modules.
• Updates Req, Finch, Gun, and Cowlib in the Mix dependency graph.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified in the upgraded dependency paths.

The React Router and Sentry APIs are aligned, checked transitive consumers remain within compatible ranges, and the Go and Mix updates show no established build or runtime contract break.

Important Files Changed

Filename	Overview
assets/package.json	Upgrades React Router and pins remediated transitive packages; inspected consumers and runtime constraints did not establish an incompatibility.
assets/src/App.tsx	Updates Sentry’s browser-router wrapper to the matching React Router v7 helper.
assets/src/instrument.ts	Updates browser tracing to Sentry’s React Router v7 integration while preserving the existing hooks.
assets/yarn.lock	Resolves the requested frontend dependency updates consistently with the manifest.
go/controller/go.mod	Updates the indirect cel-go dependency for the controller module without an established compatibility failure.
go/datastore/go.mod	Updates the indirect cel-go dependency for the datastore module without an established compatibility failure.
go/deployment-operator/go.mod	Updates the indirect cel-go dependency for the deployment operator without an established compatibility failure.
go/tools/go.mod	Aligns the tools module on cel-go 0.29.0.
mix.exs	Raises the Req override to the remediated 0.6 release line; no concrete call-site incompatibility was established.
mix.lock	Updates Req, Finch, Gun, and Cowlib to the resolved dependency versions.

_{Reviews (1): Last reviewed commit: "fix(deps): remediate PROD-5108 security ..." | Re-trigger Greptile}