mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-09-06 18:27:14 +00:00
Kuzz007
032dbabc39
Two real, forward-compatible fixes for npm audit's high-severity advisories (not the downgrades npm audit fix --force offers): - react-router (GHSA-qwww-vcr4-c8h2, RSC CSRF bypass): react-router-dom is frozen at 7.18.1, pinning the vulnerable react-router@7.18.1 -- no newer react-router-dom release exists pointing at the fixed line. react-router itself has shipped the real fix at 8.3.0. Migrated the 9 files importing from react-router-dom (all using plain createBrowserRouter/RouterProvider/useLocation/useNavigate/Outlet, no RSC anywhere) to import from react-router directly instead. - brace-expansion/minimatch (GHSA-mh99-v99m-4gvg): fixed for eslint's own dependency chain (minimatch@10.2.5, used by eslint itself, storybook, typescript-eslint, swagger-client) via a scoped "minimatch@^10" override forcing brace-expansion to the now-published 5.0.8 patch -- within the range minimatch@10.2.5 already declares wanting (^5.0.5), so this isn't a version-pin workaround, just unblocking a patch release npm's resolver hadn't picked up. One advisory remains genuinely unfixable from our side: eslint-plugin-jsx-a11y pins minimatch@^3.1.2 (old major, never patched); forcing it to the 10.x line via override breaks npm's own dependency-tree validation (a real incompatibility, not just an npm quirk), so this needs an eslint-plugin-jsx-a11y release bumping its own minimatch. Lint-time only, no untrusted input reaches it -- ci.yml's Audit step comment updated to reflect the new, smaller remaining scope. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>