build(deps): bump dependabot dependencies by JeanMarcMilletScality · Pull Request #1176 · scality/core-ui

JeanMarcMilletScality · 2026-07-28T17:12:15Z

TL;DR

Consolidates the pending dependabot dependency bumps into one PR, plus the advisories that were published while those PRs sat open. Takes npm audit from 9 root advisories on development/1.0 down to 0 — every package this branch touches is now free of high and critical advisories.

Also bumps dependency-review-action v3 → v5 (the v3 Node 20 runtime is deprecated) and enables show-patched-versions.

Context

Dependabot opened these as individual PRs, but none can merge: the claude-review check fails on every dependabot PR because repository secrets aren't exposed to the dependabot Actions context. This PR ships the same bumps from a normal branch instead. (The CI gate itself is tracked for a separate fix.)

Changes

Dependency	From → To	Kind	Why
`react-router`	7.13.0 → 7.18.2	direct (ships)	5 high advisories — see Approach
`react-router-dom`	7.13.0 → 7.18.2	direct (ships)	kept in lockstep with `react-router` — see Approach
`@babel/core`	7.28.6 → 7.29.7	dev	source-map bug fixes
`esbuild`	0.25.12 → 0.28.1	transitive	security: dev-server path traversal, Deno integrity
`markdown-it`	14.1.1 → 14.3.0	transitive	security/perf + CommonMark fixes
`linkify-it`	5.0.0 → 5.0.2	transitive	security: fuzzy-link ReDoS
`ws`	8.20.1 → 8.21.1	transitive	security: remote memory-exhaustion DoS
`postcss`	8.5.15 → 8.5.24	transitive	security: path traversal in source-map auto-loading
`fast-uri`	3.1.2 → 3.1.5	transitive	security: host confusion via backslash authority delimiter (GHSA-7p8r-x3mc-p8w7)
`js-yaml`	4.1.1 → 4.3.1, 3.14.2 → 3.15.1	transitive	security: quadratic DoS via merge-key chains, then via `!!omap` resolution (GHSA-5p4m-2wfm-xmqj)
`nanoid`	3.3.15 → 3.3.18	transitive	security: custom generators loop indefinitely when size is zero (GHSA-2v37-7h3g-55p8)
`brace-expansion`	nested copies → 1.1.18 / 2.1.4 / 5.0.9	transitive	security: exponential-expansion DoS, plus a bypass of that mitigation (GHSA-rgw5-rvv9-x895)
`dependency-review-action`	v3 → v5	CI	Node 20 runtime deprecated; adds `show-patched-versions`

Approach

Why react-router-dom moves with react-router. Dependabot's PR bumped only react-router. But react-router-dom@7.13.0 hard-pins react-router@7.13.0, so bumping react-router alone leaves a second, nested copy of react-router in the tree — two separate Router contexts, which breaks useNavigate/useLocation for consumers whose provider comes from the other copy.

Before — react-router bumped alone (dependabot #1131):

node_modules/react-router                                 7.18.2
node_modules/react-router-dom                             7.13.0
node_modules/react-router-dom/node_modules/react-router   7.13.0   // ← duplicate: 2nd Router context

After — pair bumped together (this PR):

$ npm ls react-router
├─┬ react-router-dom@7.18.2
│ └── react-router@7.18.2 deduped
└── react-router@7.18.2

Why 7.18.2 and not 8.3.0. Dependabot #1174 proposes react-router@8.3.0. That isn't viable here:

react-router@8.3.0 declares peers react >=19.2.7, but core-ui's peerDependencies still allow react ^18.0.0. Taking it would silently drop React 18 support for every consumer.
react-router-dom has no 8.x release at all — it stops at 7.18.2. So bumping react-router to 8 recreates exactly the duplicate-Router-context problem described above.

7.18.2 is a minor bump that clears all five open react-router advisories, and keeps peers at react >=18. Four were fixed in 7.18.0 (open redirect via backslash in <Link>/useNavigate, RSCErrorHandler missing protocol validation, arbitrary constructor injection in deserializeErrors(), unauthenticated DoS via inefficient route matching). The fifth — GHSA-qwww-vcr4-c8h2, RSC mode CSRF bypass — was initially published as fixed only in 8.3.0, but GitHub has since backported it to 7.18.2, so no React 19 bump is needed.

core-ui imports only MemoryRouter, BrowserRouter, useLocation, useNavigate — all unchanged across 7.x.

Why brace-expansion is not just dev tooling. An earlier revision of this description claimed the flagged copy was reachable only from dev tooling. That is wrong, and worth stating plainly because dependency-review-action already defaults to fail-on-scopes: runtime — a genuinely dev-only package would never have tripped the gate. The lockfile shows a runtime-scoped path (dev: false):

react-query@3 → broadcast-channel → rimraf@3 → glob@7 → brace-expansion@1.x

So these bumps are a real fix, not noise. All three lines are now at their patched releases (1.1.18 / 2.1.4 / 5.0.9).

Why the action bump rides along. For pull_request events GitHub runs the workflow definition from the PR head, so bumping the action here takes effect on this PR's own check — which is how the v5 result below was produced. show-patched-versions is the input that matters: the v3 failure summary named only the vulnerable package, which is what made GHSA-qwww-vcr4-c8h2 and GHSA-mh99-v99m-4gvg look unfixable when in-range patches already existed. Both v4.0.0 and v5.0.0 are runtime-only majors with no input changes, so fail-on-severity: high carries over untouched. permissions: contents: read is now declared explicitly (the value GitHub's own README specifies) instead of inheriting the repository default.

Review focus

🟡 package.json › react-router + react-router-dom — both pinned to exactly 7.18.2; confirm they stay aligned (this is the shipped runtime dep).
🟡 .github/workflows/dependency-review.yaml — v5 requires Actions runner ≥ v2.327.1, which GitHub-hosted ubuntu-latest exceeds. If this job ever moves to a self-hosted runner, that floor has to be met.
⚪ package-lock.json — changes are scoped to the deps above plus their @babel/* / @esbuild/* sub-packages; no unrelated churn.

How to test

npm ci          # 0 vulnerabilities
npm test        # 428 tests / 43 suites pass
npm run build   # tsc, exit 0
npm ls react-router   # exactly one copy, 7.18.2

Remaining advisories

None. All 56 packages this branch changes relative to development/1.0 were swept against the GitHub advisory database; none carries a high or critical advisory, and npm audit reports 0. The dependency-review check passes on v5 with fail-on-severity: high.

Note that development/1.0 itself still reports open advisories from packages this PR does not touch — that is a separate cleanup, not a regression here.

References

Supersedes these dependabot PRs (can be closed once this merges):

build(deps): bump react-router from 7.13.0 to 7.15.1 #1131 — bump react-router 7.13.0 → 7.15.1
chore(deps-dev): bump @babel/core from 7.28.6 to 7.29.6 #1134 — bump @babel/core 7.28.6 → 7.29.6 (dev)
build(deps): bump markdown-it from 14.1.1 to 14.2.0 #1136 — bump markdown-it 14.1.1 → 14.2.0
build(deps): bump esbuild from 0.25.12 to 0.28.1 #1145 — bump esbuild 0.25.12 → 0.28.1
build(deps): bump linkify-it from 5.0.0 to 5.0.1 #1149 — bump linkify-it 5.0.0 → 5.0.1
chore(deps): bump ws from 8.20.1 to 8.21.1 #1154 — bump ws 8.20.1 → 8.21.1
chore(deps): bump linkify-it from 5.0.0 to 5.0.2 #1166 — bump linkify-it 5.0.0 → 5.0.2
chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 #1167 — bump fast-uri 3.1.2 → 3.1.4
chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 #1175 — bump postcss 8.5.15 → 8.5.23

Should be closed as not viable rather than superseded:

chore(deps): bump react-router from 7.13.0 to 8.3.0 #1174 — bump react-router 7.13.0 → 8.3.0 (React-19-only peer; no matching react-router-dom 8.x)

Replaces #1157, which was opened from a branch with an invalid build/ prefix.

🤖 Generated with Claude Code

Ships the pending dependabot bumps in a single PR, since the individual dependabot PRs cannot merge (the claude-review check fails on dependabot PRs because repository secrets are not exposed to that context). Direct: - react-router 7.13.0 -> 7.15.1 - react-router-dom 7.13.0 -> 7.15.1 (kept in lockstep with react-router to avoid a duplicate/mismatched react-router copy and split Router context) Transitive / dev (resolved to latest compatible, >= dependabot proposals): - @babel/core 7.28.6 -> 7.29.7 (security/bug fixes; dev only) - esbuild 0.25.12 -> 0.28.1 (security: dev-server path traversal, Deno integrity) - markdown-it 14.1.1 -> 14.3.0 (security/perf; CommonMark fixes) - linkify-it 5.0.0 -> 5.0.2 (security: fuzzy-link ReDoS) - ws 8.20.1 -> 8.21.1 (security: remote memory-exhaustion DoS) All 513 tests pass and tsc build succeeds. Vulnerability count 5 -> 1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bert-e · 2026-07-28T17:12:18Z

Hello jeanmarcmilletscality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request `TBA`
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2026-07-28T17:12:25Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

Advisories published after the first commit on this branch left 6 open vulnerabilities. Clears all of them that have a fix within the existing ranges. Direct: - react-router 7.15.1 -> 7.18.1 - react-router-dom 7.15.1 -> 7.18.1 (kept in lockstep, as before) Clears 4 high advisories: open redirect via backslash in Link and useNavigate, RSCErrorHandler missing protocol validation (XSS), arbitrary constructor injection in deserializeErrors(), and unauthenticated DoS via inefficient route matching. All fixed in 7.18.0. core-ui uses only MemoryRouter/BrowserRouter/useLocation/ useNavigate, unchanged across 7.x. Not taking react-router 8.3.0 (dependabot #1174): it peers on react >=19.2.7 while core-ui still supports react ^18, and react-router-dom has no 8.x release, so bumping react-router alone would reintroduce the duplicate-Router-context problem this branch fixes. The one remaining react-router advisory (RSC mode CSRF bypass, fixed only in 8.3.0) does not apply - core-ui does not use RSC mode. Transitive: - postcss 8.5.15 -> 8.5.24 (path traversal in source-map auto-loading) - fast-uri 3.1.2 -> 3.1.4 (host confusion via backslash authority delimiter and failed IDN canonicalization) - js-yaml 4.1.1 -> 4.3.0, 3.14.2 -> 3.15.0 (quadratic-complexity DoS via YAML merge-key chains) - brace-expansion nested copies -> latest in each line (1.1.16, 2.1.3, 5.0.8), clearing the exponential-expansion DoS advisories brace-expansion still reports one advisory whose range is <=5.0.7 with no 1.x/2.x backport, so the 1.1.16 and 2.1.3 copies stay flagged. It is reachable only from dev tooling (eslint, glob, jest, storybook, copyfiles) and never ships in dist; clearing it needs eslint 8->10, glob and jest majors, which is out of scope here. All 513 tests pass and tsc build succeeds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bert-e · 2026-07-28T17:32:40Z

Conflict

There is a conflict between your branch improvement/dependabot-dependency-bumps and the
destination branch development/1.0.

Please resolve the conflict on the feature branch (improvement/dependabot-dependency-bumps).

git fetch && \
git checkout origin/improvement/dependabot-dependency-bumps && \
git merge origin/development/1.0

Resolve merge conflicts and commit

git push origin HEAD:improvement/dependabot-dependency-bumps

…t/dependabot-dependency-bumps Conflict was in package-lock.json only; package.json auto-merged (base's 0.226.0 version bump and valalint removal alongside this branch's react-router pins). Resolved by taking development/1.0's lockfile wholesale and re-applying this branch's bumps through npm, rather than hand-merging lockfile hunks: git checkout origin/development/1.0 -- package-lock.json npm install npm update @babel/core esbuild markdown-it linkify-it ws postcss \ fast-uri js-yaml brace-expansion nanoid This keeps the base's own lockfile changes intact (including the @typescript-eslint/parser and rule-tester removals that came with dropping valalint). Verified the result changes exactly the same 66 package versions relative to the new base as it did before the merge, with no packages added or removed. All 43 suites / 428 tests pass, tsc build exits 0, lint clean. The test count differs from the pre-merge 513 because development/1.0 deleted the three valalint rule-tester suites and added three component suites; the test files at this commit are identical to the base's. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bert-e · 2026-07-28T17:57:45Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

damiengillesscality

Please handle the bump in the other applications and share with the team the info

bert-e · 2026-07-29T09:21:12Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

JeanMarcMilletScality · 2026-07-29T09:38:58Z

/approve

bert-e · 2026-07-29T09:39:05Z

Build failed

The build for commit did not succeed in branch improvement/dependabot-dependency-bumps

The following options are set: approve

bert-e · 2026-07-29T12:46:54Z

Not authorized

I'm afraid I cannot do that, @JeanMarcMilletScality:

/bypass_build_status

You don't have enough credentials to use bypass_build_status.

Please edit or delete the corresponding comment so I can move on.

The following options are set: approve

Five packages in this branch now have in-range patched releases that did not exist when the bumps were first made. GitHub backported the react-router advisory into the 7.x line, and four new high advisories were published after the last CI run. - react-router / react-router-dom 7.18.1 -> 7.18.2 GHSA-qwww-vcr4-c8h2 (RSC mode CSRF bypass) is now patched in 7.18.2, not only in 8.3.0. Peers stay `react >=18`, so React 18 support is preserved and react-router-dom@7.18.2 still pins react-router exactly, keeping a single Router context. - brace-expansion 1.1.16/2.1.3/5.0.8 -> 1.1.18/2.1.4/5.0.9 GHSA-mh99-v99m-4gvg was backported to the 1.x line, and GHSA-rgw5-rvv9-x895 bypasses the earlier mitigation on every line. - fast-uri 3.1.4 -> 3.1.5 (GHSA-7p8r-x3mc-p8w7) - js-yaml 4.3.0 -> 4.3.1, 3.15.0 -> 3.15.1 (GHSA-5p4m-2wfm-xmqj) - nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8) All 56 packages this branch changes relative to development/1.0 are now free of high and critical advisories, so `npm audit` reports 0 and the dependency-review gate passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

v3 runs on Node 20, which GitHub Actions has deprecated and now forces onto Node 24 with a warning. v5.0.0 makes that runtime bump official. Both v4.0.0 and v5.0.0 are runtime-only majors with no input changes, so `fail-on-severity: high` carries over unchanged. Also enables `show-patched-versions`, which adds the first patched version to the failure summary. Without it the summary only names the vulnerable package, which is what made the advisories in the previous commit look unfixable when in-range patches already existed. Declares `contents: read` explicitly rather than inheriting the repository default token permissions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

JeanMarcMilletScality · 2026-08-10T15:36:00Z

/approve

JeanMarcMilletScality · 2026-08-10T15:36:56Z

/status

bert-e · 2026-08-10T15:46:14Z

Status

check	status
➡️ Approvals	☀️

The following options are set: approve

bert-e · 2026-08-10T15:46:23Z

Queue out of order

The changeset has received all authorizations to enter the merge queue,
however the merge queue is currently in an incoherent state. In order
to protect this pull request, I have not added the changeset to the
queue.

Look into https://devdocs.scality.net/support/faq/#bert-e for guidance about
what to do next to unlock the situation, or ask for help on the #ci-support
Slack channel.

The following options are set: approve

JeanMarcMilletScality · 2026-08-11T09:17:37Z

/status

bert-e · 2026-08-11T09:17:45Z

Status

check	status
➡️ Approvals	☀️

The following options are set: approve

bert-e · 2026-08-11T09:17:58Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/1.0

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve

bert-e · 2026-08-11T09:19:00Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/1.0

Please check the status of the associated issue None.

Goodbye jeanmarcmilletscality.

JeanMarcMilletScality mentioned this pull request Jul 28, 2026

build(deps): bump dependabot dependencies #1157

Closed

damiengillesscality approved these changes Jul 29, 2026

View reviewed changes

JeanMarcMilletScality and others added 2 commits August 10, 2026 17:29

bert-e merged commit c0f64bf into development/1.0 Aug 11, 2026
8 checks passed

Uh oh!

Conversation

JeanMarcMilletScality commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TL;DR

Context

Changes

Approach

Review focus

How to test

Remaining advisories

References

Uh oh!

bert-e commented Jul 28, 2026

Hello jeanmarcmilletscality,

Uh oh!

bert-e commented Jul 28, 2026

Waiting for approval

Uh oh!

bert-e commented Jul 28, 2026

Conflict

Uh oh!

bert-e commented Jul 28, 2026

Waiting for approval

Uh oh!

damiengillesscality left a comment

Choose a reason for hiding this comment

Uh oh!

bert-e commented Jul 29, 2026

Waiting for approval

Uh oh!

JeanMarcMilletScality commented Jul 29, 2026

Uh oh!

bert-e commented Jul 29, 2026

Build failed

Uh oh!

bert-e commented Jul 29, 2026

Not authorized

Uh oh!

JeanMarcMilletScality commented Aug 10, 2026

Uh oh!

JeanMarcMilletScality commented Aug 10, 2026

Uh oh!

bert-e commented Aug 10, 2026

Status

Uh oh!

bert-e commented Aug 10, 2026

Queue out of order

Uh oh!

JeanMarcMilletScality commented Aug 11, 2026

Uh oh!

bert-e commented Aug 11, 2026

Status

Uh oh!

bert-e commented Aug 11, 2026

In the queue

Uh oh!

bert-e commented Aug 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

JeanMarcMilletScality commented Jul 28, 2026 •

edited

Loading