Update react-router to 7.18.1 to fix DoS advisory

[rajithacharith]

Purpose

Fixes the pnpm audit high-severity finding GHSA-chx6-hx7r-mcp5: React Router unauthenticated Denial of Service via inefficient route matching, affecting react-router >=7.0.0 <7.18.0.

Approach

• Bumped the workspace catalog react-router from 7.15.1 to 7.18.1 in pnpm-workspace.yaml. All console/gate apps and workspace packages consume it via catalog:, and @thunderid/react-router takes it as a peer dependency, so this covers all 15 workspace resolution paths.
• Bumped react-router-dom from 7.15.1 to 7.18.1 in samples/apps/react-vanilla-sample, which pulled the last remaining vulnerable transitive react-router.
• Regenerated pnpm-lock.yaml.

After the change every react-router/react-router-dom resolution is 7.18.1, and the advisory no longer appears in pnpm audit.

Related Issues

• N/A

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• Chores
  • Updated React Router to version 7.18.1 across the workspace and the React vanilla sample.
  • Brings the newest improvements and fixes included in this React Router release.
  • Helps ensure consistency of routing behavior between workspace packages and the sample app.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workspace catalog and React vanilla sample update React Router dependencies from 7.15.1 to 7.18.1.

Changes

Workspace dependency update

Layer / File(s)	Summary
Update React Router dependency pins pnpm-workspace.yaml, samples/apps/react-vanilla-sample/package.json	The workspace catalog and React vanilla sample dependency are updated from 7.15.1 to 7.18.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: donomalvindula, brionmario

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: upgrading react-router to address a DoS advisory.
Description check	✅ Passed	The description covers the required Purpose, Approach, Related Issues, Related PRs, Checklist, and Security sections.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!