build(deps): bump dependabot dependencies

[JeanMarcMilletScality]

TL;DR

Bumps six dependencies (react-router, react-router-dom, @babel/core, esbuild, markdown-it, linkify-it, ws) in one PR — the changes dependabot proposed across separate PRs, consolidated so they can actually land.

Context

Dependabot opened these as individual PRs, but none can merge: the claude-review check fails on every dependabot PR because repository secrets aren't exposed to the dependabot Actions context. This PR ships the same bumps from a normal branch instead. (The CI gate itself is tracked for a separate fix.)

Changes

Dependency	From → To	Kind	Why it matters
react-router	7.13.0 → 7.15.1	direct (ships)	fetcher/SSR/onError bug fixes
react-router-dom	7.13.0 → 7.15.1	direct (ships)	kept in lockstep with react-router — see Approach
@babel/core	7.28.6 → 7.29.7	dev	source-map bug fixes
esbuild	0.25.12 → 0.28.1	transitive	security: dev-server path traversal, Deno integrity
markdown-it	14.1.1 → 14.3.0	transitive	security/perf + CommonMark fixes
linkify-it	5.0.0 → 5.0.2	transitive	security: fuzzy-link ReDoS
ws	8.20.1 → 8.21.1	transitive	security: remote memory-exhaustion DoS

esbuild and ws match dependabot's proposed versions exactly; the other transitive/dev deps resolved one patch/minor newer via npm update (all within existing ranges, no breaking changes — markdown-it 14.3.0 is a single CommonMark hard-line-break fix).

Approach

Why react-router-dom moves with react-router. Dependabot's PR bumped only react-router. But react-router-dom@7.13.0 hard-pins react-router@7.13.0, so bumping react-router alone leaves a second, nested copy of react-router in the tree — two separate Router contexts, which breaks useNavigate/useLocation for consumers whose provider comes from the other copy.

Before — react-router bumped alone (dependabot #1131):

node_modules/react-router                                 7.15.1
node_modules/react-router-dom                             7.13.0
node_modules/react-router-dom/node_modules/react-router   7.13.0   // ← duplicate: 2nd Router context

After — pair bumped together (this PR):

node_modules/react-router       7.15.1
node_modules/react-router-dom   7.15.1   // ← in lockstep; single react-router copy

Verified the built lockfile contains exactly one node_modules/react-router entry.

Review focus

• 🟡 package.json › react-router + react-router-dom — both pinned to exactly 7.15.1; confirm they stay aligned (this is the shipped runtime dep). core-ui's own code uses only useLocation/useNavigate, stable across 7.x.
• ⚪ package-lock.json — changes are scoped to the six deps plus their @babel/* / @esbuild/* sub-packages; no unrelated churn.

How to test

npm ci
npm test        # 513 tests / 43 suites pass
npm run build   # tsc, exit 0

npm audit drops from 5 vulnerabilities to 1.

References

Supersedes the individual dependabot PRs (can be closed once this merges):

• build(deps): bump react-router from 7.13.0 to 7.15.1 #1131 — bump react-router 7.13.0 → 7.15.1
• chore(deps-dev): bump @babel/core from 7.28.6 to 7.29.6 #1134 — bump @babel/core 7.28.6 → 7.29.6 (dev)
• build(deps): bump markdown-it from 14.1.1 to 14.2.0 #1136 — bump markdown-it 14.1.1 → 14.2.0
• build(deps): bump esbuild from 0.25.12 to 0.28.1 #1145 — bump esbuild 0.25.12 → 0.28.1
• build(deps): bump linkify-it from 5.0.0 to 5.0.1 #1149 — bump linkify-it 5.0.0 → 5.0.1
• chore(deps): bump ws from 8.20.1 to 8.21.1 #1154 — bump ws 8.20.1 → 8.21.1

---

🤖 Generated with Claude Code

[JeanMarcMilletScality]

/approve

[JeanMarcMilletScality]

/status

[JeanMarcMilletScality]

/status

[JeanMarcMilletScality]

Superseded by #1176 — same commit, re-opened from improvement/dependabot-dependency-bumps (the build/ prefix isn't a valid Bert-E branch prefix).