From a30cd8b6a9c96cfebd06c70a0c8cdca7d02da30b Mon Sep 17 00:00:00 2001
From: Tommaso Casaburi <tom@bitsocial.net>
Date: Sun, 26 Jul 2026 17:31:38 +0700
Subject: [PATCH] chore(deps): upgrade react-router-dom to 7.18.1, bump postcss
 and brace-expansion

Clears GHSA-337j-9hxr-rhxg and GHSA-wrjc-x8rr-h8h6 (no 6.x backport) plus
GHSA-jjmj-jmhj-qwj2, which has no patch at all on the react-router-dom 6.30.x
line. Drops the now-unused @remix-run/router resolution.

Also pins postcss 8.5.23 (GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q) and adds
the brace-expansion ^5.0.5 descriptor, which was still resolving to 5.0.6.
---
 package.json |  6 ++--
 yarn.lock    | 77 ++++++++++++++++++++++++----------------------------
 2 files changed, 39 insertions(+), 44 deletions(-)

diff --git a/package.json b/package.json
index b690cacf..2aec5311 100755
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "react-dropzone": "14.3.8",
     "react-i18next": "16.6.6",
     "react-markdown": "10.1.0",
-    "react-router-dom": "6.30.4",
+    "react-router-dom": "7.18.1",
     "react-router-hash-link": "2.4.3",
     "react-virtuoso": "4.18.5",
     "rehype-raw": "7.0.0",
@@ -182,7 +182,6 @@
     "sharp": "0.35.3",
     "cacache": "19.0.1",
     "preact": "10.27.3",
-    "@remix-run/router": "1.23.2",
     "@peculiar/asn1-schema": "2.5.0",
     "@tootallnate/once": "3.0.1",
     "axios@npm:^0.27.2": "0.30.2",
@@ -190,6 +189,7 @@
     "brace-expansion@npm:^2.0.0": "2.1.2",
     "brace-expansion@npm:^2.0.1": "2.1.2",
     "brace-expansion@npm:^5.0.2": "5.0.8",
+    "brace-expansion@npm:^5.0.5": "5.0.8",
     "diff@npm:^5.0.0": "5.2.2",
     "lodash": "4.18.0",
     "picomatch@npm:^2.2.2": "2.3.2",
@@ -230,7 +230,7 @@
     "bn.js@npm:^5.2.2": "5.2.3",
     "fast-uri": "3.1.4",
     "ip-address": "10.1.1",
-    "postcss": "8.5.10",
+    "postcss": "8.5.23",
     "uuid@npm:^11.0.0": "11.1.1",
     "uuid@npm:11.1.0": "11.1.1",
     "uuid@npm:^13.0.0": "13.0.1",
diff --git a/yarn.lock b/yarn.lock
index d4613835..9de6c1dc 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6542,13 +6542,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@remix-run/router@npm:1.23.2":
-  version: 1.23.2
-  resolution: "@remix-run/router@npm:1.23.2"
-  checksum: 10c0/7096b7f2086b2cd80c9e06873b71a8317e04858c01edc06a6fed187b660408a90f47c8e120e8af4c369cf1fa6b6a316a66b0917f42b6eb8a566e98b277c50449
-  languageName: node
-  linkType: hard
-
 "@rolldown/binding-android-arm64@npm:1.0.3":
   version: 1.0.3
   resolution: "@rolldown/binding-android-arm64@npm:1.0.3"
@@ -8412,15 +8405,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"brace-expansion@npm:^5.0.5":
-  version: 5.0.6
-  resolution: "brace-expansion@npm:5.0.6"
-  dependencies:
-    balanced-match: "npm:^4.0.2"
-  checksum: 10c0/8c919869b90f61d533b341d3340be5ee4413232ea89b8246cbc2f38eb014f1d8182785c98a006eaf6111d02dc9eeffefdc240d5ac158625b2ed084dccd4bbf9b
-  languageName: node
-  linkType: hard
-
 "braces@npm:^3.0.3":
   version: 3.0.3
   resolution: "braces@npm:3.0.3"
@@ -9523,7 +9507,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cookie@npm:^1.0.2, cookie@npm:^1.1.1":
+"cookie@npm:^1.0.1, cookie@npm:^1.0.2, cookie@npm:^1.1.1":
   version: 1.1.1
   resolution: "cookie@npm:1.1.1"
   checksum: 10c0/79c4ddc0fcad9c4f045f826f42edf54bcc921a29586a4558b0898277fa89fb47be95bc384c2253f493af7b29500c830da28341274527328f18eba9f58afa112c
@@ -16860,12 +16844,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.3.11":
-  version: 3.3.11
-  resolution: "nanoid@npm:3.3.11"
+"nanoid@npm:^3.3.16":
+  version: 3.3.16
+  resolution: "nanoid@npm:3.3.16"
   bin:
     nanoid: bin/nanoid.cjs
-  checksum: 10c0/40e7f70b3d15f725ca072dfc4f74e81fcf1fbb02e491cf58ac0c79093adc9b0a73b152bcde57df4b79cd097e13023d7504acb38404a4da7bc1cd8e887b82fe0b
+  checksum: 10c0/bbf2dcffe22d2b62d16de2711752070b539c0f644c7916f823ad6521986b2078cbe524f2d6240f58c46e9141ea0c7b87a029e100c0f7f175228cacaf30e41bba
   languageName: node
   linkType: hard
 
@@ -18485,14 +18469,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"postcss@npm:8.5.10":
-  version: 8.5.10
-  resolution: "postcss@npm:8.5.10"
+"postcss@npm:8.5.23":
+  version: 8.5.23
+  resolution: "postcss@npm:8.5.23"
   dependencies:
-    nanoid: "npm:^3.3.11"
+    nanoid: "npm:^3.3.16"
     picocolors: "npm:^1.1.1"
     source-map-js: "npm:^1.2.1"
-  checksum: 10c0/c592dffa0c4873b401f01955b265538d9942f425040df5e2b8f0ad34c83773a792ea0fa5859ccc99cfb5b955b4ebff118ab7056315388dc83b107b0fa8313576
+  checksum: 10c0/ed714e635b330bb42666ecdd0c0b4f30224ded15b0b0052d6bc2b92832f2cf17d1c1141359453f96f0a84f8fbf4c405a74df187f559163b8f31131b2535455aa
   languageName: node
   linkType: hard
 
@@ -19081,16 +19065,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"react-router-dom@npm:6.30.4":
-  version: 6.30.4
-  resolution: "react-router-dom@npm:6.30.4"
+"react-router-dom@npm:7.18.1":
+  version: 7.18.1
+  resolution: "react-router-dom@npm:7.18.1"
   dependencies:
-    "@remix-run/router": "npm:1.23.3"
-    react-router: "npm:6.30.4"
+    react-router: "npm:7.18.1"
   peerDependencies:
-    react: ">=16.8"
-    react-dom: ">=16.8"
-  checksum: 10c0/1b25ab26a288da852f7b58eec5c14b3f37919e6773a557cd846d3a05d7a7d890c8d49bda93c0a7f497f240df1df8b0ad50635f990aafb55f2fc545ad8269a822
+    react: ">=18"
+    react-dom: ">=18"
+  checksum: 10c0/5efb99f2f09cecf445788f3459a8f5ff952ed85061f2d40f8de25fdd6e2ce6aeea8e40e4bacad470ea42a45d0460feb6fb59c62f14d87720b43d5c96cd9b2cb6
   languageName: node
   linkType: hard
 
@@ -19106,14 +19089,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"react-router@npm:6.30.4":
-  version: 6.30.4
-  resolution: "react-router@npm:6.30.4"
+"react-router@npm:7.18.1":
+  version: 7.18.1
+  resolution: "react-router@npm:7.18.1"
   dependencies:
-    "@remix-run/router": "npm:1.23.3"
+    cookie: "npm:^1.0.1"
+    set-cookie-parser: "npm:^2.6.0"
   peerDependencies:
-    react: ">=16.8"
-  checksum: 10c0/fb6de7d1002bcab9ea12c4072d93792eca494f1e4f30cfec334ccb6523756d23ce3e093c7c1241399296cebed94789a3fb89f96ee76004e0e746458a8f6bab33
+    react: ">=18"
+    react-dom: ">=18"
+  peerDependenciesMeta:
+    react-dom:
+      optional: true
+  checksum: 10c0/1a559de58d656bad5565f2232e4f4fab7e9f5282dfaf95bc24f195a06e7e85b281077fe5c21ed3ff527e3d90d930447e0d0bb0f0713950d2a56ad0f0377a7d09
   languageName: node
   linkType: hard
 
@@ -20031,7 +20019,7 @@ __metadata:
     react-grab: "npm:0.1.48"
     react-i18next: "npm:16.6.6"
     react-markdown: "npm:10.1.0"
-    react-router-dom: "npm:6.30.4"
+    react-router-dom: "npm:7.18.1"
     react-router-hash-link: "npm:2.4.3"
     react-scan: "npm:0.5.3"
     react-virtuoso: "npm:4.18.5"
@@ -20139,6 +20127,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"set-cookie-parser@npm:^2.6.0":
+  version: 2.7.2
+  resolution: "set-cookie-parser@npm:2.7.2"
+  checksum: 10c0/4381a9eb7ee951dfe393fe7aacf76b9a3b4e93a684d2162ab35594fa4053cc82a4d7d7582bf397718012c9adcf839b8cd8f57c6c42901ea9effe33c752da4a45
+  languageName: node
+  linkType: hard
+
 "set-function-length@npm:^1.2.2":
   version: 1.2.2
   resolution: "set-function-length@npm:1.2.2"