You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update the vulnerable transitive dependencies reported by Dependabot:
PostCSS to 8.5.18 in the root and example-app workspaces.
React Router and React Router DOM to 7.18.1 in the documentation toolchain.
brace-expansion to 5.0.8 in the example app.
Keep the existing workspace-level override strategy so regenerated lockfiles retain the patched versions.
This PR touches exactly four dependency metadata/lockfile files and does not expand beyond dependency maintenance. No runtime or public CLI behavior changed.
Dependabot alert #54 (React Router RSC CSRF) was verified as not applicable and dismissed with a rationale: the repository uses Rspress declarative mode and has no unstable RSC APIs, Framework Mode, or manual SSR/hydration code.
Validation
pnpm check:tooling
pnpm --dir website build
pnpm audit --audit-level high in examples/test-app — no known vulnerabilities
git diff --check
Docs and skills were not updated because this is dependency metadata and lockfile maintenance only.
Reviewed exact head 6f7c50b5. Dependency/security review is clean: root and test-app overrides match their regenerated locks; patched PostCSS, React Router, and brace-expansion versions are present with affected versions absent; the separate React Router RSC advisory is credibly not applicable to the Rspress declarative site. Current checks are green, and no device evidence is needed for dependency metadata only.
P2 — PR body scope disclosure: add the required statement that this touches four dependency metadata/lockfile files and did not expand beyond dependency maintenance. The PR is otherwise ready from this review.
Dependency/security review clean at 2bbca749: patched versions satisfy the advisory floors, workspace overrides match both lockfiles, and the only React Router consumer is the green Rspress documentation build. Residual: Dependabot’s default-branch alert state will recalculate after merge. Ready for human review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ready-for-humanValid work that needs human implementation, judgment, or maintainer merge
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update the vulnerable transitive dependencies reported by Dependabot:
This PR touches exactly four dependency metadata/lockfile files and does not expand beyond dependency maintenance. No runtime or public CLI behavior changed.
Dependabot alert #54 (React Router RSC CSRF) was verified as not applicable and dismissed with a rationale: the repository uses Rspress declarative mode and has no unstable RSC APIs, Framework Mode, or manual SSR/hydration code.
Validation
pnpm check:toolingpnpm --dir website buildpnpm audit --audit-level highinexamples/test-app— no known vulnerabilitiesgit diff --checkDocs and skills were not updated because this is dependency metadata and lockfile maintenance only.