BUG-57023: upgrade react-router-dom to ^7.18.0 to remediate react-router arbitrary constructor injection vulnerability

[midnight-clue]

Context & Problem

Dependabot alert tchiotludo#72 on getyourguide/akhq reports that react-router (a transitive dependency of react-router-dom) is vulnerable in the range >= 6.4.0, < 7.18.0 (GHSA-337j-9hxr-rhxg, medium severity — arbitrary constructor injection). The current client/package.json pinned react-router-dom at ^7.16.0, which resolved to a vulnerable react-router version. See BUG-57023.

Solution

Since react-router is a direct dependency of react-router-dom, the clean fix is to bump react-router-dom to ^7.18.0 in client/package.json (rather than adding a manual npm override), which pulls in the patched react-router >= 7.18.0. Ran npm install inside client/ to regenerate client/package-lock.json with the patched dependency tree. No application code changes were required.

Verification

• react-router-dom upgraded from ^7.16.0 to ^7.18.0 in client/package.json
• client/package-lock.json regenerated inside client/; resolved react-router version confirmed at 7.18.2 (>= 7.18.0, outside the vulnerable range)
• Resolved react-router-dom version confirmed at 7.18.2
• npm run lint and npm test run — pre-existing failures unrelated to this change (legacy .eslintrc vs. eslint v9 flat-config requirement, and a pre-existing Simulate test setup issue) confirmed present on dev prior to this change; no new failures introduced by the dependency bump

---

🔍 Braintrust trace