Possible fix(deps): react-router 8.2.0 → 7.18.2, 8.3.0 (GHSA-qwww-vcr4-c8h2) in pnpm-lock.yaml

[begininvoke]

Spotted what might be an issue in pnpm-lock.yaml around line 1.

Vulnerability GHSA-qwww-vcr4-c8h2 (HIGH severity) affects react-router@8.2.0 declared in pnpm-lock.yaml. It is a follow-up to CVE-2026-22030 and addresses additional Cross-Site Request Forgery (CSRF) flows in the unstable React Server Components (RSC) code paths. Impact: if the application uses the unstable RSC APIs (RSC endpoints/server actions), a remote attacker can host a malicious page that causes a victim's browser to issue forged cross-site requests to those RSC endpoints, executing state-changing server actions under the victim's authenticated session. Exploitability is high when RSC APIs are in use; if the app does not import unstable RSC APIs, practical exposure is limited per the advisory, but the vulnerable dependency should still be patched to stay within supported versions and avoid regression risk. Fixed versions: 7.18.2 (7.x line) and 8.3.0 (8.x line). Since the project is on 8.2.0, the correct fix is to upgrade to >= 8.3.0.

Something like this might fix it:

Upgrade react-router to the patched version and regenerate the lockfile:

```diff
--- a/package.json
+++ b/package.json
@@
   "dependencies": {
-    "react-router": "8.2.0",
+    "react-router": "^8.3.0",
     ...
   }
```

Then run:

```bash
# Regenerates pnpm-lock.yaml with react-router@8.3.0
pnpm install
# or update directly:
pnpm update react-router@^8.3.0
```

If react-router is only a transitive dependency and cannot be bumped directly, force the patched version via a pnpm override:

```diff
--- a/package.json
+++ b/package.json
@@
-  "pnpm": {},
+  "pnpm": {
+    "overrides": {
+      "react-router@<8.3.0": ">=8.3.0"
+    }
+  },
```

Post-fix validation: run `pnpm audit --prod`, confirm `pnpm why react-router` resolves to 8.3.0+, and if the application uses unstable RSC APIs, verify CSRF defenses on RSC/server-action endpoints (e.g., Origin/Sec-Fetch-Site validation) as defense in depth.

For reference: rule GHSA-qwww-vcr4-c8h2. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.