fix(security): update react-router to patched v7 (CVEs)

[birme]

Summary

• Bumped react-router and react-router-dom from 7.13.1 to 7.18.3 (range ^7.18.3 for both, kept version-aligned).
• Addresses advisories GHSA-49rj-9fvp-4h2h (8.1), GHSA-8646-j5j9-6r62 (8.0), GHSA-f22v-gfqf-p8f3 (7.5). npm audit now reports zero react-router advisories at any level.
• Stayed within React Router v7 (latest patched v7 is 7.18.3; latest dist-tag is now v8 major — intentionally not taken).
• Dual-package check: no nested divergent copies — both node_modules/react-router-dom/node_modules/react-router and node_modules/react-router/node_modules/react-router-dom are none (OK).

Test plan

• Tests pass (npm test) — 18 files / 147 tests
• TypeScript compiles (npm run typecheck)
• Lint clean (npm run lint)
• react-router / react-router-dom aligned, no nested copy
• npm audit --audit-level=high clear for react-router

Closes #647

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

[birme]

code-reviewer (daily-backlog-pr Phase 3):

Code Review

Verdict: LGTM

Summary: Clean, minimal security patch bumping react-router/react-router-dom from 7.13.1 to 7.18.3 (within v7, staying off the v8 major). No app-facing breaking changes and the lockfile is internally consistent.

---

Blocking

None.

---

Warnings

None.

---

Suggestions

• package.json:39-40 — All react-router API usage in the app is confined to stable v7 hooks/components with no behavioral changes between 7.13 and 7.18: BrowserRouter, Routes, Route, Navigate, useLocation, useNavigate, useSearchParams, useParams, useRouteError (verified across src/App.tsx, src/components/header.tsx, calls-page, production-line, use-calls-navigation.tsx, router-error.tsx, and ~8 others). No data-router APIs (loaders/actions, json(), defer(), Form, redirect()) are used, so the turbo-stream / Location-header / DOM XSS advisory surfaces are either not exercised or now patched. No action needed — noted for reviewer confidence.
• Imports correctly target react-router (v7 consolidated the react-router-dom re-exports into the core package); react-router-dom is retained as a dep, which is fine.

---

NPM Migration / Lockfile Hygiene

• package-lock.json is consistent: react-router-dom@7.18.3 -> react-router@7.18.3 (versions aligned, no divergent nested copy), package.json ^7.18.3 ranges match the resolved 7.18.3 entries, and engines/dependencies blocks are intact. No yarn reintroduction, no yarn.lock. Dual-package check per PR body confirms no nested divergent copies.

PR body correctly reports the prior version as 7.13.1 (range ^7.13.0), matching the removed lockfile lines.

[birme]

Code Review

Verdict: LGTM

Summary: Clean, correctly-scoped dependency security bump. react-router/react-router-dom moved from ^7.13.0 (resolved 7.13.1) to ^7.18.3, which fully patches all three cited advisories and, in fact, every currently-known high-severity react-router advisory. package.json and package-lock.json are consistent, versions stay aligned, and there is no dual-package divergence.

---

Blocking

None.

---

Warnings

None.

---

Suggestions

• package.json:39-40 — Consider whether staying on the caret range ^7.18.3 is desired long-term. The latest dist-tag is now v8; the PR intentionally pins to patched v7, which is the right call to avoid an unreviewed major bump. Worth a follow-up issue to plan the eventual v8 migration.

---

Verification notes (npm migration hygiene + CVE coverage)

• CVE coverage confirmed against GitHub Advisory DB:
  • GHSA-49rj-9fvp-4h2h (turbo-stream RCE, 8.1) — vulnerable >= 7.0.0, <= 7.14.1, patched 7.14.2. 7.18.3 safe.
  • GHSA-8646-j5j9-6r62 (RSC redirect XSS, 8.0) — vulnerable >= 7.7.0, < 7.13.2, patched 7.13.2. 7.18.3 safe.
  • GHSA-f22v-gfqf-p8f3 (stored XSS via Location header) — vulnerable >= 7.5.1, < 7.13.2, patched 7.13.2. 7.18.3 safe.
  • The previously-installed 7.13.1 was affected by all three (in particular the RCE, which needs 7.14.2), so the bump was necessary.
  • Bonus: 7.18.3 also clears the newer high-severity GHSA-qwww-vcr4-c8h2 (vulnerable < 7.18.2) and every other current react-router advisory (all < 7.18.x). No known react-router advisory affects 7.18.3.
• Lockfile consistency (npm, not yarn): package.json ranges (^7.18.3 both) match package-lock.json root ranges; both packages resolve to 7.18.3; react-router-dom's pinned dep on react-router is 7.18.3. No yarn.lock present or added.
• Dual-package hazard: No nested divergent copies — node_modules/react-router-dom/node_modules/react-router and node_modules/react-router/node_modules/react-router-dom are both absent (single hoisted copy).
• Build sanity: npm ci + npm run typecheck (tsc --noEmit) pass cleanly on the checked-out branch.
• Changeset scope is exactly package.json + package-lock.json — no unrelated changes.

Categories 1-7 (TypeScript, error handling, architecture, testing, WebRTC/SDP) are N/A — this PR touches no source or test files.

[birme]

Code Review

Verdict: LGTM

Summary: Clean minimal bump of react-router/react-router-dom 7.13.1→7.18.3, staying within v7; lock and manifest consistent.

Reviewed against the Open Intercom code-reviewer rubric (TypeScript correctness, error handling, architecture, testing, security, WebRTC/SDP, npm-migration hygiene). No Blocking items; CI green. Approving and squash-merging via daily-backlog-pr Phase 3.