fix(deps): patch react-router advisory and retire its stale exception

[parthrohit22]

Summary

react-router 7.18.2 is the backported patch for GHSA-qwww-vcr4-c8h2 (high, runtime). The policy exception PARTHA carried for 7.18.1 therefore no longer has an advisory to accept, and the dependency-audit gate was correctly reporting it as stale.

This bumps to the patched version and retires the exception in the same change, because neither half is valid alone:

• retiring the exception alone leaves an unpatched high-severity runtime advisory and the gate blocks (verified);
• bumping alone trips the gate's stale-acknowledgement check — this is what is currently red on chore(deps): bump react-router and react-router-dom in /apps/frontend #261 and chore(deps): bump the frontend-minor-and-patch group across 1 directory with 8 updates #265.

It also fixes a defect in the gate's own tests: they bound their fixtures to the shipped react-router entry, so retiring that entry broke five tests at once. The gate failed because the vulnerability it guards had been fixed, which is the wrong incentive — it makes keeping the exception the path of least resistance.

Advisory data (GET /advisories/GHSA-qwww-vcr4-c8h2):

severity: high
react-router  >= 7.12.0, < 7.18.2  first_patched = 7.18.2
react-router  >= 8.0.0,  < 8.3.0   first_patched = 8.3.0

The previous reason text predated the 7.x backport and described 8.3.0 as the only patched release, which is no longer accurate. No React 19 migration is required.

Linked issue

Related to #261, #265 — unblocks both.

What changed

Tooling / dependencies

• apps/frontend/package.json, package-lock.json — react-router-dom / react-router 7.18.1 → 7.18.2 (patch bump, taken from chore(deps): bump react-router and react-router-dom in /apps/frontend #261).
• scripts/dependency-audit-policy.json — removed the now-stale GHSA-qwww-vcr4-c8h2 acknowledgement. acknowledged is now empty, which is the healthy steady state.
• scripts/dependency-audit.test.mjs — behavioural tests rebound to a synthetic entry; shipped-policy expectations rewritten to hold for any exception set, including none.

No application code, contracts, or schemas changed.

Acceptance criteria completed

• High-severity runtime advisory GHSA-qwww-vcr4-c8h2 resolved by upgrade, not by exception.
• Stale acknowledgement removed; npm audit reports 0 vulnerabilities.
• Gate still fails for every condition it failed for before (expiry, package identity drift, version drift, package removal, reachability).
• Test suite no longer breaks when an exception is retired.

Testing performed

All five Frontend CI steps, run locally in order after a clean npm ci:

$ npm --prefix apps/frontend ci
found 0 vulnerabilities

$ node --test scripts/dependency-audit.test.mjs
ℹ tests 9   ℹ pass 9   ℹ fail 0

$ node scripts/dependency-audit.mjs
No blocking findings (0 accepted).

$ npm --prefix apps/frontend run lint
(clean)

$ npm --prefix apps/frontend run test
Test Files  39 passed (39)
Tests  220 passed (220)

$ npm --prefix apps/frontend run build
✓ built in 710ms

Negative check — the gate still blocks when it should. Retiring the exception without the bump (react-router 7.18.1 present) correctly fails:

Blocking:
  high  runtime  GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass ...
1 blocking finding(s).

Reachability is now asserted directly: no unstable_, createStaticHandler, createStaticRouter, StaticRouterProvider, deserializeErrors, react-router/server, or @react-router/{node,express,serve} usage anywhere in apps/frontend/src. PARTHA remains a client-only Vite SPA, so the RSC surface the advisory covers is not mounted.

Screenshots

Not applicable — no UI change.

Security and data considerations

Resolves a high-severity runtime advisory by upgrading to the patched release rather than continuing to accept it. No auth, owner-scoping, migration, logging, or secret-handling changes. No egress policy change. The audit gate keeps every one of its failure modes; only its test fixtures were decoupled from the live policy.

Dependencies and blocked work

None. Once this merges, #261 becomes redundant (its bump is included here) and #265 should be rebased — its remaining 7 bumps are unrelated to this advisory.

Scope changes or remaining work

None. The lucide-react v1 (#250) and React 19 (#249/#203) majors are separate breaking upgrades and are deliberately not touched here.

Contributor checklist

• Follows the branch naming and commit conventions
• Targets dev
• Verified locally with the commands above
• No secrets, .env, dist/, or generated artifacts committed
• No applied migration edited
• Docs/behaviour claims match real repository state