Resolve Dependabot alerts (cmov, postcss, react-router) by benhillis · Pull Request #4087 · microsoft/openvmm

benhillis · 2026-07-29T23:51:40Z

Resolves the three open Dependabot security alerts.

Alert	Package	Change	Severity
#45	`cmov` (Cargo.lock)	0.5.3 → 0.5.4 (GHSA-3rjw-m598-pq24)	medium
#46	`postcss` (petri/logview)	8.5.15 → 8.5.25 (GHSA-r28c-9q8g-f849)	high
#47	`react-router` (petri/logview)	7.18.0 → 8.3.0 (GHSA-qwww-vcr4-c8h2)	high

react-router migration

react-router v8 merged the separate react-router-dom package into react-router. react-router-dom stopped at 7.18.2 (still within the vulnerable range), so the fix requires moving to react-router v8. This PR:

Replaces the react-router-dom dependency with react-router@^8.3.0 in package.json.
Switches all 15 import sites from react-router-dom to react-router.

The APIs used (Link, useParams, useSearchParams, useLocation, useNavigate, HashRouter, Routes, Route, Navigate) are unchanged in v8.

Misc

Fixed a stale .gitignore entry (logview_new/dist* → logview/dist*) so the Vite build output stays ignored.

Verification

npm audit → 0 vulnerabilities
vite build → succeeds

Address three open Dependabot security alerts: - cmov 0.5.3 -> 0.5.4 (GHSA-3rjw-m598-pq24) in Cargo.lock - postcss 8.5.15 -> 8.5.25 (GHSA-r28c-9q8g-f849) in petri/logview - react-router 7.18.0 -> 8.3.0 (GHSA-qwww-vcr4-c8h2) in petri/logview react-router v8 merged the separate react-router-dom package (which stopped at 7.18.2, within the vulnerable range) into react-router, so migrate the logview app off react-router-dom by updating package.json and switching all import sites to "react-router". The APIs used (Link, useParams, useSearchParams, useLocation, useNavigate, HashRouter, Routes, Route, Navigate) are unchanged in v8. Also fix a stale .gitignore entry (logview_new/dist* -> logview/dist*) so the Vite build output stays ignored. Verified with `npm audit` (0 vulnerabilities) and `vite build`. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d6a7eb95-877c-4daa-a2f5-33c0f14d50f9

Copilot

Pull request overview

Updates Rust and Node dependencies to remediate three Dependabot security alerts, including migrating Petri Logview from react-router-dom to react-router v8.

Changes:

Bump Rust dependency cmov in Cargo.lock to address GHSA-3rjw-m598-pq24.
Update postcss (and related lockfile entries) and migrate routing imports/dependency to react-router@^8.3.0.
Fix stale .gitignore pattern so Logview Vite build output remains ignored.

Reviewed changes

Copilot reviewed 14 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`petri/logview/src/tests.tsx`	Switch routing imports from `react-router-dom` to `react-router`.
`petri/logview/src/test_details.tsx`	Switch routing imports from `react-router-dom` to `react-router`.
`petri/logview/src/table_defs/tests.tsx`	Switch `Link` import to `react-router`.
`petri/logview/src/table_defs/test_details.tsx`	Switch `Link` import to `react-router`.
`petri/logview/src/table_defs/runs.tsx`	Switch `Link` import to `react-router`.
`petri/logview/src/table_defs/run_details.tsx`	Switch `Link` import to `react-router`.
`petri/logview/src/search.tsx`	Switch navigation hook imports to `react-router`.
`petri/logview/src/runs.tsx`	Switch routing imports from `react-router-dom` to `react-router`.
`petri/logview/src/run_details.tsx`	Switch routing imports from `react-router-dom` to `react-router`.
`petri/logview/src/menu.tsx`	Switch `Link` import to `react-router`.
`petri/logview/src/main.tsx`	Switch router component imports (`HashRouter`, `Routes`, etc.) to `react-router`.
`petri/logview/src/log_viewer.tsx`	Switch routing imports from `react-router-dom` to `react-router`.
`petri/logview/src/docs/docs.tsx`	Switch `Link` import to `react-router`.
`petri/logview/package.json`	Replace `react-router-dom` with `react-router@^8.3.0`.
`petri/logview/package-lock.json`	Lockfile updates for `react-router` v8 and `postcss` update, including dependency graph changes.
`Cargo.lock`	Update `cmov` 0.5.3 → 0.5.4.
`.gitignore`	Update ignored Logview build output path (`logview_new` → `logview`).

Files not reviewed (1)

petri/logview/package-lock.json: Generated file

github-actions · 2026-07-30T01:05:41Z

2 Petri tests failed (1 unstable)

Copilot

Pull request overview

Copilot reviewed 14 out of 17 changed files in this pull request and generated no new comments.

Files not reviewed (1)

petri/logview/package-lock.json: Generated file

Comments suppressed due to low confidence (2)

petri/logview/package-lock.json:1727

react-router@8.3.0 now requires Node >=22.22.0. The logview package.json engines.node currently allows Node 20.19.x / >=22.12.0, which is inconsistent and may cause confusing npm install engine/peer failures for developers using the advertised Node range. The package.json engines (and any related docs) should be updated to match this new minimum.
petri/logview/package.json:8
react-router@8.3.0 declares peer dependencies react/react-dom >=19.2.7 (see package-lock), but package.json currently allows 19.2.1. This can lead to peer-dep install warnings or failures when the lockfile is regenerated or when install behavior changes. Consider raising the minimum React versions to align with the router’s stated requirements.

    "react": "^19.2.1",
    "react-dom": "^19.2.1",
    "react-router": "^8.3.0"

Address PR review feedback: react-router@8.3.0 requires Node >=22.22.0 and peer deps react/react-dom >=19.2.7, but package.json/README still advertised the older Node ^20.19.0 || >=22.12.0 range and React ^19.2.1. - Bump engines.node to >=22.22.0 and update the README prerequisite. - Raise react/react-dom minimums to ^19.2.7. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d6a7eb95-877c-4daa-a2f5-33c0f14d50f9

Copilot

Pull request overview

Copilot reviewed 15 out of 18 changed files in this pull request and generated no new comments.

Files not reviewed (1)

petri/logview/package-lock.json: Generated file

Comments suppressed due to low confidence (1)

petri/logview/package.json:8

The dependency switch from react-router-dom to react-router looks complete in code, but petri/logview/README.md still lists react-router-dom as a runtime dependency (line 33). Please update the README dependency list to avoid misleading setup instructions.

    "react": "^19.2.7",
    "react-dom": "^19.2.7",
    "react-router": "^8.3.0"

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d6a7eb95-877c-4daa-a2f5-33c0f14d50f9

Copilot

Pull request overview

Copilot reviewed 15 out of 18 changed files in this pull request and generated no new comments.

Files not reviewed (1)

petri/logview/package-lock.json: Generated file

benhillis requested a review from a team as a code owner July 29, 2026 23:51

Copilot AI review requested due to automatic review settings July 29, 2026 23:51

Copilot started reviewing on behalf of benhillis July 29, 2026 23:52 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

Comment thread petri/logview/package.json Outdated

Comment thread petri/logview/package-lock.json

smalis-msft approved these changes Jul 30, 2026

View reviewed changes

Merge branch 'main' into fix-dependabot-alerts

6552769

Copilot AI review requested due to automatic review settings July 30, 2026 15:28

Copilot started reviewing on behalf of smalis-msft July 30, 2026 15:29 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 30, 2026 15:59

Copilot started reviewing on behalf of benhillis July 30, 2026 15:59 View session

smalis-msft approved these changes Jul 30, 2026

View reviewed changes

Copilot AI reviewed Jul 30, 2026

View reviewed changes

docs: update logview README dependency list to react-router

d018ec3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d6a7eb95-877c-4daa-a2f5-33c0f14d50f9

Copilot AI review requested due to automatic review settings July 30, 2026 16:14

Copilot started reviewing on behalf of benhillis July 30, 2026 16:15 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Resolve Dependabot alerts (cmov, postcss, react-router) - #4087

Resolve Dependabot alerts (cmov, postcss, react-router)#4087
benhillis wants to merge 4 commits into
microsoft:mainfrom
benhillis:fix-dependabot-alerts

benhillis commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

benhillis commented Jul 29, 2026

react-router migration

Misc

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants