Claude/stitch dependabot vulns by AlexAxthelm · Pull Request #201 · RMI/stitch

AlexAxthelm · 2026-07-29T14:03:38Z

Resolves Dependabot alert #63: upgrades react-router 7.18.1 → 8.3.0 (GHSA-qwww-vcr4-c8h2, no 7.x backport). v8 drops react-router-dom, so imports move to the react-router package and Node is bumped to 22 (engines + Dockerfile); no API changes. Also bumps the dev-only transitive brace-expansion 5.0.7 → 5.0.8 (GHSA-mh99-v99m-4gvg) to clear npm audit.

AI-assisted (Claude Code): import rename + dependency/Node bumps. Verified: lint, 232/232 tests, build, and npm audit (0 vulns) all pass.

Dependabot alert #63 flags react-router 7.18.1 (HIGH, GHSA-qwww-vcr4-c8h2, "RSC Mode CSRF Bypass"). There is no 7.x backport; the fix is only in 8.3.0. The advisory is RSC-mode-only and this app is a plain Vite SPA that does not use RSC mode, so it was not actually exploitable — but the version bump clears the alert. react-router v8 removes the react-router-dom package, so imports move to the react-router package (imported names unchanged). v8 also requires Node >=22.22.0. - deps: react-router-dom ^7.18.1 -> react-router ^8.3.0; regenerate lockfile - engines.node >=20.0.0 -> >=22.22.0 (also updates CI via node-version-file) - Dockerfile build stage node:20-alpine -> node:22-alpine - rename react-router-dom imports to react-router across 8 source files AI-assisted: import rename, dependency/lockfile bump, and Node version bump were made with Claude Code. Verified manually: lint, 232/232 tests, vite build, and prettier all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

npm audit flagged brace-expansion 5.0.7 (HIGH, GHSA-mh99-v99m-4gvg): DoS via unbounded expansion length causing an out-of-memory crash. Pre-existing and dev-only — it comes in transitively via eslint -> minimatch -> brace-expansion, so it never ships in the app bundle. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Copilot

Pull request overview

Updates the Stitch frontend to address Dependabot security alerts by upgrading React Router to v8 (moving imports from react-router-dom to react-router) and aligning runtime/build tooling with the new Node engine requirements.

Changes:

Upgrade routing dependency: react-router-dom@7 → react-router@8 and update all related imports/mocks.
Bump Node engine requirement for the frontend package and update the frontend Docker build image to Node 22.
Update lockfile to reflect new dependency graph (including dev-only brace-expansion bump).

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
deployments/stitch-frontend/src/test/utils.jsx	Switch test router wrapper import to `react-router`.
deployments/stitch-frontend/src/pages/ResourceDetailPage.test.jsx	Update Vitest mock/importActual target to `react-router`.
deployments/stitch-frontend/src/pages/ResourceDetailPage.jsx	Update hook imports (`useParams`, `useNavigate`) to `react-router`.
deployments/stitch-frontend/src/pages/MergeCandidateReviewPage.jsx	Update `Link` import to `react-router`.
deployments/stitch-frontend/src/main.jsx	Update `BrowserRouter` import to `react-router`.
deployments/stitch-frontend/src/components/ResourcesView.jsx	Update `useSearchParams` import to `react-router`.
deployments/stitch-frontend/src/components/ResourcesTable.jsx	Update `Link` import to `react-router`.
deployments/stitch-frontend/src/App.jsx	Update route/link imports to `react-router`.
deployments/stitch-frontend/package.json	Replace `react-router-dom` with `react-router@^8.3.0`; bump Node engines to `>=22.22.0`.
deployments/stitch-frontend/package-lock.json	Lockfile updates for React Router v8, cookie dependency switch, and `brace-expansion` bump.
deployments/stitch-frontend/Dockerfile	Bump build stage base image from Node 20 to Node 22.

Files not reviewed (1)

deployments/stitch-frontend/package-lock.json: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build


github-actions · 2026-07-29T14:08:10Z

CD summary `8434e20`

Deployments (3)

service	url	fqdn
api	open	`pr-201-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
entity-linkage	open	`pr-201-entity-linkage.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
stitch-llm	open	`pr-201-stitch-llm.purplegrass-c07d0a94.westus2.azurecontainerapps.io`

Database (1)

db_name	postgres_host	postgres_port	postgres_db
pr_201	`stitch-dev.postgres.database.azure.com`	`5432`	`pr_201`

Jobs (2)

job	image	postgres_db	api_url	auth_mode
db-migrations	`ghcr.io/rmi/stitch-api:pr-201@sha256:62850bbc414f1f8630eae279c3e448362e8884ef3f9ad2d7468a2ec7bd1ac078`	`pr_201`
seed	`ghcr.io/rmi/stitch-seed:pr-201@sha256:bfc49134d5fb1fc917a710560f626135989c8af2ed683afd6df79ad35ebaebe0`		`https://pr-201-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io/api/v1`	`stitch-client-bearer-token`

Images (4)

build_time	commit_time	git_sha	image	image_digest
2026-07-29T14:03:59Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-api:pr-201`	`ghcr.io/rmi/stitch-api:pr-201@sha256:62850bbc414f1f8630eae279c3e448362e8884ef3f9ad2d7468a2ec7bd1ac078`
2026-07-29T14:04:04Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-entity-linkage:pr-201`	`ghcr.io/rmi/stitch-entity-linkage:pr-201@sha256:eafa937b64635785a5182d05970b9502974d2f681f7872c55ec2b2ddebf8ada3`
2026-07-29T14:03:58Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-seed:pr-201`	`ghcr.io/rmi/stitch-seed:pr-201@sha256:bfc49134d5fb1fc917a710560f626135989c8af2ed683afd6df79ad35ebaebe0`
2026-07-29T14:04:08Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-stitch-llm:pr-201`	`ghcr.io/rmi/stitch-stitch-llm:pr-201@sha256:c667e347c0012eaf1a33c849b5503e89fb4aa00307aaba65819d67f0a9fd872f`

AlexAxthelm · 2026-07-29T14:16:56Z

@jasonbrownrmi This PR would include a bump to node-22, and the migration from react-router-dom to react-router. Do you have any problems with that?

Note that this isn't strictly required (dependabot is flagging a codepath we don't use)

github-actions · 2026-07-29T14:40:47Z

CD summary `8434e20`

Frontend: https://witty-mushroom-017a3dc1e-201.westus2.1.azurestaticapps.net

Deployments (4)

service	url	fqdn
api	open	`pr-201-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
entity-linkage	open	`pr-201-entity-linkage.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
frontend	https://witty-mushroom-017a3dc1e-201.westus2.1.azurestaticapps.net
stitch-llm	open	`pr-201-stitch-llm.purplegrass-c07d0a94.westus2.azurecontainerapps.io`

Database (1)

db_name	postgres_host	postgres_port	postgres_db
pr_201	`stitch-dev.postgres.database.azure.com`	`5432`	`pr_201`

Jobs (2)

job	image	postgres_db	api_url	auth_mode
db-migrations	`ghcr.io/rmi/stitch-api:pr-201@sha256:62850bbc414f1f8630eae279c3e448362e8884ef3f9ad2d7468a2ec7bd1ac078`	`pr_201`
seed	`ghcr.io/rmi/stitch-seed:pr-201@sha256:bfc49134d5fb1fc917a710560f626135989c8af2ed683afd6df79ad35ebaebe0`		`https://pr-201-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io/api/v1`	`stitch-client-bearer-token`

Images (4)

build_time	commit_time	git_sha	image	image_digest
2026-07-29T14:03:59Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-api:pr-201`	`ghcr.io/rmi/stitch-api:pr-201@sha256:62850bbc414f1f8630eae279c3e448362e8884ef3f9ad2d7468a2ec7bd1ac078`
2026-07-29T14:04:04Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-entity-linkage:pr-201`	`ghcr.io/rmi/stitch-entity-linkage:pr-201@sha256:eafa937b64635785a5182d05970b9502974d2f681f7872c55ec2b2ddebf8ada3`
2026-07-29T14:03:58Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-seed:pr-201`	`ghcr.io/rmi/stitch-seed:pr-201@sha256:bfc49134d5fb1fc917a710560f626135989c8af2ed683afd6df79ad35ebaebe0`
2026-07-29T14:04:08Z	2026-07-29T14:03:38Z	`7d2c3f3`	`ghcr.io/rmi/stitch-stitch-llm:pr-201`	`ghcr.io/rmi/stitch-stitch-llm:pr-201@sha256:c667e347c0012eaf1a33c849b5503e89fb4aa00307aaba65819d67f0a9fd872f`

github-actions · 2026-07-29T14:51:47Z

CD summary `e608e16`

Frontend: https://witty-mushroom-017a3dc1e-201.westus2.1.azurestaticapps.net

Deployments (4)

service	url	fqdn
api	open	`pr-201-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
entity-linkage	open	`pr-201-entity-linkage.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
frontend	https://witty-mushroom-017a3dc1e-201.westus2.1.azurestaticapps.net
stitch-llm	open	`pr-201-stitch-llm.purplegrass-c07d0a94.westus2.azurecontainerapps.io`

Database (1)

db_name	postgres_host	postgres_port	postgres_db
pr_201	`stitch-dev.postgres.database.azure.com`	`5432`	`pr_201`

Jobs (1)

job	image	postgres_db
db-migrations	`ghcr.io/rmi/stitch-api:pr-201@sha256:3a2cc2709a9dfbe00f10157dcb07677f56ee10e379d8359fd889848a074b9550`	`pr_201`

Images (4)

build_time	commit_time	git_sha	image	image_digest
2026-07-29T14:47:16Z	2026-07-29T14:46:50Z	`52acdae`	`ghcr.io/rmi/stitch-api:pr-201`	`ghcr.io/rmi/stitch-api:pr-201@sha256:3a2cc2709a9dfbe00f10157dcb07677f56ee10e379d8359fd889848a074b9550`
2026-07-29T14:47:14Z	2026-07-29T14:46:50Z	`52acdae`	`ghcr.io/rmi/stitch-entity-linkage:pr-201`	`ghcr.io/rmi/stitch-entity-linkage:pr-201@sha256:fc478cfaebf96cdafa01ec08dfafab977e466bdcbce44794dc890fa89a26fe6e`
2026-07-29T14:47:07Z	2026-07-29T14:46:50Z	`52acdae`	`ghcr.io/rmi/stitch-seed:pr-201`	`ghcr.io/rmi/stitch-seed:pr-201@sha256:c4743b49e3a34683a4c3b205e98f451db130b6f5e9071c16ee6ec4f8b5d8b5de`
2026-07-29T14:47:09Z	2026-07-29T14:46:50Z	`52acdae`	`ghcr.io/rmi/stitch-stitch-llm:pr-201`	`ghcr.io/rmi/stitch-stitch-llm:pr-201@sha256:82fc63b483ea7c3d45bbd7c8f7b767cd4d36e03096ca0e66bac1217516d88438`

github-actions · 2026-07-30T08:06:26Z

CD summary `e2c860d`

Frontend: https://witty-mushroom-017a3dc1e-201.westus2.1.azurestaticapps.net

Deployments (4)

service	url	fqdn
api	open	`pr-201-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
entity-linkage	open	`pr-201-entity-linkage.purplegrass-c07d0a94.westus2.azurecontainerapps.io`
frontend	https://witty-mushroom-017a3dc1e-201.westus2.1.azurestaticapps.net
stitch-llm	open	`pr-201-stitch-llm.purplegrass-c07d0a94.westus2.azurecontainerapps.io`

Database (1)

db_name	postgres_host	postgres_port	postgres_db
pr_201	`stitch-dev.postgres.database.azure.com`	`5432`	`pr_201`

Jobs (1)

job	image	postgres_db
db-migrations	`ghcr.io/rmi/stitch-api:pr-201@sha256:4bf5de8bd799448a404023de7bc9095b82e812d5878548c804107e287c5b4945`	`pr_201`

Images (4)

build_time	commit_time	git_sha	image	image_digest
2026-07-30T08:01:53Z	2026-07-30T07:58:26Z	`fa127ba`	`ghcr.io/rmi/stitch-api:pr-201`	`ghcr.io/rmi/stitch-api:pr-201@sha256:4bf5de8bd799448a404023de7bc9095b82e812d5878548c804107e287c5b4945`
2026-07-30T08:01:49Z	2026-07-30T07:58:26Z	`fa127ba`	`ghcr.io/rmi/stitch-entity-linkage:pr-201`	`ghcr.io/rmi/stitch-entity-linkage:pr-201@sha256:f4e7d2661ec2f172e7b9ecc948c8fcc3950d9c0a0a07ef7fe171ee261264cec5`
2026-07-30T08:01:51Z	2026-07-30T07:58:26Z	`fa127ba`	`ghcr.io/rmi/stitch-seed:pr-201`	`ghcr.io/rmi/stitch-seed:pr-201@sha256:9fa02cab35bcd47e2b1973beacd93682b632ccc370c74d2047d2c2853e571c04`
2026-07-30T08:01:48Z	2026-07-30T07:58:26Z	`fa127ba`	`ghcr.io/rmi/stitch-stitch-llm:pr-201`	`ghcr.io/rmi/stitch-stitch-llm:pr-201@sha256:cf501d398e2c6158f98ffdb08509265093f9afef322d44c73f133c91d7ca2452`

AlexAxthelm and others added 2 commits July 29, 2026 15:47

AlexAxthelm requested a review from Copilot July 29, 2026 14:03

AlexAxthelm self-assigned this Jul 29, 2026

AlexAxthelm temporarily deployed to development July 29, 2026 14:03 — with GitHub Actions Inactive

Copilot started reviewing on behalf of AlexAxthelm July 29, 2026 14:04 View session

AlexAxthelm temporarily deployed to development July 29, 2026 14:04 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 29, 2026 14:05 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 29, 2026 14:06 — with GitHub Actions Inactive

Copilot AI reviewed Jul 29, 2026

View reviewed changes

Comment thread deployments/stitch-frontend/Dockerfile

@@ -1,4 +1,4 @@

FROM node:20-alpine AS build

FROM node:22-alpine AS build

AlexAxthelm had a problem deploying to development July 29, 2026 14:07 — with GitHub Actions Failure

AlexAxthelm requested a review from jasonbrownrmi July 29, 2026 14:15

AlexAxthelm temporarily deployed to development July 29, 2026 14:39 — with GitHub Actions Inactive

Merge branch 'main' into claude/stitch-dependabot-vulns-ddd82f

e608e16

AlexAxthelm temporarily deployed to development July 29, 2026 14:47 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 29, 2026 14:48 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 29, 2026 14:49 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 29, 2026 14:50 — with GitHub Actions Inactive

AlexAxthelm marked this pull request as ready for review July 29, 2026 14:59

Merge branch 'main' into claude/stitch-dependabot-vulns-ddd82f

e2c860d

AlexAxthelm temporarily deployed to development July 30, 2026 08:01 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 30, 2026 08:02 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 30, 2026 08:03 — with GitHub Actions Inactive

AlexAxthelm temporarily deployed to development July 30, 2026 08:05 — with GitHub Actions Inactive

AlexAxthelm added the no-deploy label Jul 30, 2026

AlexAxthelm temporarily deployed to development July 30, 2026 09:15 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Claude/stitch dependabot vulns - #201

Claude/stitch dependabot vulns#201
AlexAxthelm wants to merge 4 commits into
mainfrom
claude/stitch-dependabot-vulns-ddd82f

AlexAxthelm commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

AlexAxthelm commented Jul 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -1,4 +1,4 @@
		FROM node:20-alpine AS build
		FROM node:22-alpine AS build

Uh oh!

Conversation

AlexAxthelm commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Jul 29, 2026

CD summary 8434e20

Uh oh!

AlexAxthelm commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026

CD summary 8434e20

Uh oh!

github-actions Bot commented Jul 29, 2026

CD summary e608e16

Uh oh!

github-actions Bot commented Jul 30, 2026

CD summary e2c860d

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

CD summary `8434e20`

AlexAxthelm commented Jul 29, 2026 •

edited

Loading

CD summary `8434e20`

CD summary `e608e16`

CD summary `e2c860d`