security: upgrade audited frontend dependencies #357

New issue

Closed

opened 2026-07-16 21:03:42 +02:00 by dries · 0 comments

dries commented

2026-07-16 21:03:42 +02:00

Owner

What to build

Update frontend production and development dependencies with published security fixes, prioritizing React Router, Vite, and the jsdom/undici test chain while preserving current application behavior.

Acceptance criteria

React Router is upgraded to a release that resolves the currently reported high advisories.
Vite and affected transitive development dependencies are upgraded to patched releases.
Remaining audit findings are documented with applicability and rationale rather than ignored silently.
The lockfile contains no avoidable high-severity advisories.
Frontend lint, typecheck, unit tests, production build, and relevant end-to-end tests pass.
No unused compatibility code or dependency overrides remain after direct upgrades.

Blocked by

None - can start immediately.

## What to build Update frontend production and development dependencies with published security fixes, prioritizing React Router, Vite, and the jsdom/undici test chain while preserving current application behavior. ## Acceptance criteria - [ ] React Router is upgraded to a release that resolves the currently reported high advisories. - [ ] Vite and affected transitive development dependencies are upgraded to patched releases. - [ ] Remaining audit findings are documented with applicability and rationale rather than ignored silently. - [ ] The lockfile contains no avoidable high-severity advisories. - [ ] Frontend lint, typecheck, unit tests, production build, and relevant end-to-end tests pass. - [ ] No unused compatibility code or dependency overrides remain after direct upgrades. ## Blocked by None - can start immediately.