fix: upgrade react-router to 8.3.0 (GHSA-qwww-vcr4-c8h2)

[anupamme]

Summary

Upgrade react-router from 8.0.1 to 8.3.0 to fix GHSA-qwww-vcr4-c8h2.

Vulnerability

Field	Value
ID	GHSA-qwww-vcr4-c8h2
Severity	HIGH
Scanner	trivy
Rule	GHSA-qwww-vcr4-c8h2
File	package-lock.json
Assessment	Pattern match — needs manual review

Description: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

Evidence

Scanner confirmation: trivy rule GHSA-qwww-vcr4-c8h2 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web application - XSS and injection vulnerabilities can affect end users.

Changes

• package.json
• package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-router@​8.0.1 ⏵ 8.3.0	-26	+16		-1

View full report