chore(monorepo): update dependency @react-router/node to v7.9.4 [security] by renovate[bot] · Pull Request #1534 · suddenlyGiovanni/suddenlygiovanni.dev

renovate · 2026-01-08T23:03:41Z

This PR contains the following updates:

Package	Change	Age	Confidence
@react-router/node (source)	`7.7.0` → `7.9.4`

React Router has Path Traversal in File Session Storage

CVE-2025-61686 / GHSA-9583-h5hc-x8cw

More information

Details

If applications use createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files.

Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information.

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

remix-run/react-router (@react-router/node)

`v7.9.4`

Compare Source

Patch Changes

Validate format of incoming session ids (#14426)
Updated dependencies:
- react-router@7.9.4

`v7.9.3`

Compare Source

Patch Changes

Updated dependencies:
- react-router@7.9.3

`v7.9.2`

Compare Source

Patch Changes

Updated dependencies:
- react-router@7.9.2

`v7.9.1`

Compare Source

Patch Changes

Updated dependencies:
- react-router@7.9.1

`v7.9.0`

Compare Source

Minor Changes

Stabilize middleware and context APIs. (#14215)

We have removed the unstable_ prefix from the following APIs and they are now considered stable and ready for production use:
- RouterContextProvider
- createContext
- createBrowserRouter getContext option
- <HydratedRouter> getContext prop
Please see the Middleware Docs, the Middleware RFC, and the Client-side Context RFC for more information.

Patch Changes

Updated dependencies:
- react-router@7.9.0

`v7.8.2`

Compare Source

Patch Changes

Updated dependencies:
- react-router@7.8.2

`v7.8.1`

Compare Source

Patch Changes

Updated dependencies:
- react-router@7.8.1

`v7.8.0`

Compare Source

Patch Changes

[UNSTABLE] Change getLoadContext signature (type GetLoadContextFunction) when future.unstable_middleware is enabled so that it returns an unstable_RouterContextProvider instance instead of a Map used to contruct the instance internally (#14097)
- This also removes the type unstable_InitialContext export
- ⚠️ This is a breaking change if you have adopted middleware and are using a custom server with a getLoadContext function
Updated dependencies:
- react-router@7.8.0

`v7.7.1`

Compare Source

Patch Changes

Updated dependencies:
- react-router@7.7.1

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-01-08T23:03:50Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-01-08T23:03:58Z

🔄 Preview deployment started... Please wait while we deploy your changes!

socket-security · 2026-01-08T23:04:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@react-router/node@7.9.4

View full report

github-actions · 2026-01-08T23:04:08Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 744 in 08647f0

'@babel/helper-optimise-call-expression@7.27.1':

socket-security · 2026-01-08T23:04:08Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

github-actions · 2026-01-08T23:05:47Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-01-19T19:12:06Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-01-19T19:13:47Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-01-19T21:59:32Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-01-19T21:59:50Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-01-23T14:31:06Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-01-23T14:31:10Z

🧹 Starting cleanup of preview environment resources...

github-actions · 2026-01-23T14:31:14Z

❌ Preview environment cleanup failure.

Cleanup Status:

Fly App: success
GitHub Environment: failure
Container Images: skipped

Some resources may require manual cleanup. Check the workflow logs for details.

github-actions · 2026-01-23T14:31:29Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-01-23T19:35:34Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-01-23T19:37:38Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-02-02T23:10:15Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-02-02T23:10:38Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-02-12T15:43:08Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-02-12T15:45:19Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-04-08T20:45:32Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-04-08T20:47:56Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-04-09T02:46:23Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-04-09T02:46:37Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-04-15T09:16:27Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-04-15T09:16:40Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-04-21T22:15:05Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-04-21T22:15:23Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

…rity]

github-actions · 2026-04-29T15:14:50Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-04-29T15:16:31Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

github-actions · 2026-04-29T15:24:04Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6891 in 2b1f617

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-04-29T15:24:05Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6904 in 2b1f617

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-04-29T15:24:07Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6917 in 2b1f617

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-04-29T15:24:08Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6984 in 2b1f617

'@babel/helper-optimise-call-expression@7.27.1':

github-actions · 2026-04-29T15:24:09Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 6994 in 2b1f617

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-04-29T15:24:10Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 7003 in 2b1f617

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-04-29T15:24:11Z

[misspell] _{reported by reviewdog 🐶}
"optimise" is a misspelling of "optimize"

suddenlygiovanni.dev/pnpm-lock.yaml

Line 7012 in 2b1f617

'@babel/helper-optimise-call-expression': 7.27.1

github-actions · 2026-04-29T21:12:44Z

🔄 Preview deployment started... Please wait while we deploy your changes!

github-actions · 2026-04-29T21:12:57Z

❌ Preview deployment failure.

Deployment failed. Please check the workflow logs for more details.

renovate Bot added the dependencies Pull requests that update a dependency file label Jan 8, 2026

github-actions Bot reviewed Jan 8, 2026

View reviewed changes

renovate Bot force-pushed the renovate/npm-react-router-node-vulnerability branch from 08647f0 to b784c1d Compare January 19, 2026 19:11

renovate Bot changed the title ~~chore(monorepo): update dependency @react-router/node to v7.9.4 [security]~~ chore(monorepo): update dependency @react-router/node to v7.9.4 [security] - autoclosed Jan 23, 2026

renovate Bot closed this Jan 23, 2026

renovate Bot deleted the renovate/npm-react-router-node-vulnerability branch January 23, 2026 14:30

renovate Bot changed the title ~~chore(monorepo): update dependency @react-router/node to v7.9.4 [security] - autoclosed~~ chore(monorepo): update dependency @react-router/node to v7.9.4 [security] Jan 23, 2026

renovate Bot reopened this Jan 23, 2026

renovate Bot force-pushed the renovate/npm-react-router-node-vulnerability branch 2 times, most recently from b784c1d to 2613cc8 Compare January 23, 2026 19:30

renovate Bot force-pushed the renovate/npm-react-router-node-vulnerability branch from 2613cc8 to 7e7d344 Compare February 12, 2026 15:42

renovate Bot force-pushed the renovate/npm-react-router-node-vulnerability branch from eeeb6bb to 56ef85e Compare April 8, 2026 20:45

renovate Bot had a problem deploying to fly-preview-1534 April 8, 2026 20:45 Error

renovate Bot had a problem deploying to fly-preview-1534 April 8, 2026 20:45 Failure

renovate Bot had a problem deploying to fly-preview-1534 April 9, 2026 02:46 Failure

renovate Bot had a problem deploying to fly-preview-1534 April 15, 2026 09:16 Failure

renovate Bot had a problem deploying to fly-preview-1534 April 21, 2026 22:14 Failure

chore(monorepo): update dependency @react-router/node to v7.9.4 [secu…

2b1f617

…rity]

renovate Bot force-pushed the renovate/npm-react-router-node-vulnerability branch from 56ef85e to 2b1f617 Compare April 29, 2026 15:09

renovate Bot had a problem deploying to fly-preview-1534 April 29, 2026 15:09 Error

renovate Bot had a problem deploying to fly-preview-1534 April 29, 2026 15:09 Failure

github-actions Bot reviewed Apr 29, 2026

View reviewed changes

renovate Bot had a problem deploying to fly-preview-1534 April 29, 2026 21:06 Failure

Conversation

renovate Bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

React Router has Path Traversal in File Session Storage

Details

Severity

References

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

coderabbitai Bot commented Jan 8, 2026

Review skipped

Uh oh!

github-actions Bot commented Jan 8, 2026

Uh oh!

socket-security Bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

socket-security Bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 8, 2026

Uh oh!

github-actions Bot commented Jan 19, 2026

Uh oh!

github-actions Bot commented Jan 19, 2026

Uh oh!

github-actions Bot commented Jan 19, 2026

Uh oh!

github-actions Bot commented Jan 19, 2026

Uh oh!

github-actions Bot commented Jan 23, 2026

Uh oh!

github-actions Bot commented Jan 23, 2026

Uh oh!

github-actions Bot commented Jan 23, 2026

Cleanup Status:

Uh oh!

github-actions Bot commented Jan 23, 2026

Uh oh!

github-actions Bot commented Jan 23, 2026

Uh oh!

github-actions Bot commented Jan 23, 2026

Uh oh!

github-actions Bot commented Feb 2, 2026

Uh oh!

github-actions Bot commented Feb 2, 2026

Uh oh!

github-actions Bot commented Feb 12, 2026

Uh oh!

github-actions Bot commented Feb 12, 2026

Uh oh!

github-actions Bot commented Apr 8, 2026

Uh oh!

github-actions Bot commented Apr 8, 2026

Uh oh!

github-actions Bot commented Apr 9, 2026

Uh oh!

github-actions Bot commented Apr 9, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

github-actions Bot commented Apr 21, 2026

renovate Bot commented Jan 8, 2026 •

edited

Loading

socket-security Bot commented Jan 8, 2026 •

edited

Loading

socket-security Bot commented Jan 8, 2026 •

edited

Loading