npm audit flags GHSA-qwww-vcr4-c8h2 (React Router RSC-mode CSRF bypass), which covers react-router 7.12.0 through 8.2.0. The fix is in 8.3.0, a major upgrade from our ^7.18.1. The frontend is a client-only Vite SPA with no RSC server actions, and API CSRF protection is Flask's own, so the advisory is not exploitable here. The CI npm audit step allowlists this single advisory ID until the v8 migration lands (same pattern as the pip-audit PYSEC ignore). This issue tracks doing the react-router-dom v8 upgrade properly: review the v8 breaking changes, migrate, and remove the allowlist.
npm audit flags GHSA-qwww-vcr4-c8h2 (React Router RSC-mode CSRF bypass), which covers react-router 7.12.0 through 8.2.0. The fix is in 8.3.0, a major upgrade from our ^7.18.1. The frontend is a client-only Vite SPA with no RSC server actions, and API CSRF protection is Flask's own, so the advisory is not exploitable here. The CI npm audit step allowlists this single advisory ID until the v8 migration lands (same pattern as the pip-audit PYSEC ignore). This issue tracks doing the react-router-dom v8 upgrade properly: review the v8 breaking changes, migrate, and remove the allowlist.