mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 19:21:33 +02:00
Moves react-router-dom/react-router 7.16.0 -> 7.18.1, off the range flagged by GHSA-wrjc-x8rr-h8h6 (open redirect via backslash in Link/ useNavigate), GHSA-h8fp-f39c-q6mh (RSC), and GHSA-337j-9hxr-rhxg (SSR hydration). The latter two need RSC/SSR, neither of which this client-only SPA uses; the open-redirect one is the only reachable path (post-login redirect), already guarded by sanitizeRedirectTarget. Stays within the existing ^7.16.0 caret, no new transitive deps. Rebuilt the static bundle. npm audit now reports 0 vulnerabilities.