Follow-up to #880. GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass, high) is patched only in react-router 8.3.0; there is no 7.x backport (7.18.1 is the version-7 dist-tag tip) and react-router-dom — what apps/admin actually depends on — has no v8 at all as of 2026-07-25, so moving off the vulnerable range means migrating the admin to the react-router package across a major. Per the advisory, the flaw is only reachable through the unstable RSC APIs; the admin is a Vite SPA with zero unstable_* react-router imports (grep-verified 2026-07-25). #880 therefore allowlisted the GHSA in pnpm-workspace.yaml (auditConfig.ignoreGhsas) rather than force the major in an audit-gate fix.
The allowlist has no expiry mechanism, so this issue is the expiry:
Follow-up to #880. GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass, high) is patched only in react-router 8.3.0; there is no 7.x backport (7.18.1 is the
version-7dist-tag tip) andreact-router-dom— whatapps/adminactually depends on — has no v8 at all as of 2026-07-25, so moving off the vulnerable range means migrating the admin to thereact-routerpackage across a major. Per the advisory, the flaw is only reachable through the unstable RSC APIs; the admin is a Vite SPA with zerounstable_*react-router imports (grep-verified 2026-07-25). #880 therefore allowlisted the GHSA inpnpm-workspace.yaml(auditConfig.ignoreGhsas) rather than force the major in an audit-gate fix.The allowlist has no expiry mechanism, so this issue is the expiry:
react-router-domv8, would make this a routine bump.apps/admin(swapreact-router-domimports forreact-router, walk the v8 upgrade guide, full admin UAT — routing touches every screen).GHSA-qwww-vcr4-c8h2frompnpm-workspace.yamland verify with ci.yml's probe steps (pnpm dlx pnpm@11.13.0 audit --audit-level=highexits 0 with no ignores needed for it).