@checkstack/automation-frontend 0.12.8 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @checkstack/automation-frontend
 
+## 0.13.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/gitops-frontend@0.8.0
+  - @checkstack/script-packages-frontend@0.5.0
+  - @checkstack/secrets-frontend@0.4.0
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/template-engine@0.4.13
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.12.8
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/automation-frontend",
-  "version": "0.12.8",
+  "version": "0.13.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
@@ -16,33 +16,33 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/auth-common": "0.16.0",
-    "@checkstack/auth-frontend": "0.15.0",
-    "@checkstack/automation-common": "0.10.2",
-    "@checkstack/ai-common": "0.6.7",
-    "@checkstack/catalog-common": "2.8.1",
-    "@checkstack/common": "0.23.0",
-    "@checkstack/frontend-api": "0.17.0",
-    "@checkstack/gitops-frontend": "0.7.9",
-    "@checkstack/integration-common": "0.9.10",
-    "@checkstack/script-packages-frontend": "0.4.18",
-    "@checkstack/secrets-frontend": "0.3.17",
-    "@checkstack/signal-frontend": "0.3.7",
-    "@checkstack/template-engine": "0.4.12",
-    "@checkstack/ui": "1.30.0",
+    "@checkstack/auth-common": "0.17.0",
+    "@checkstack/auth-frontend": "0.16.0",
+    "@checkstack/automation-common": "0.10.3",
+    "@checkstack/ai-common": "0.6.8",
+    "@checkstack/catalog-common": "2.8.2",
+    "@checkstack/common": "0.24.0",
+    "@checkstack/frontend-api": "0.18.0",
+    "@checkstack/gitops-frontend": "0.8.0",
+    "@checkstack/integration-common": "0.9.11",
+    "@checkstack/script-packages-frontend": "0.5.0",
+    "@checkstack/secrets-frontend": "0.4.0",
+    "@checkstack/signal-frontend": "0.3.8",
+    "@checkstack/template-engine": "0.4.13",
+    "@checkstack/ui": "1.31.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^8.0.0",
     "@dnd-kit/utilities": "^3.2.2",
     "date-fns": "^4.4.0",
     "lucide-react": "^1.17.0",
     "react": "19.2.7",
-    "react-router-dom": "^7.16.0",
+    "react-router": "^8.3.0",
     "yaml": "^2.6.1"
   },
   "devDependencies": {
     "typescript": "^5.0.0",
     "@types/react": "^19.0.0",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/scripts": "0.7.6"
+    "@checkstack/scripts": "0.7.7"
   }
 }

package/src/components/RunAsServiceAccountPicker.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Link } from "react-router-dom";
+import { Link } from "react-router";
 import { ExternalLink, KeyRound, ShieldCheck } from "lucide-react";
 import { usePluginClient } from "@checkstack/frontend-api";
 import { AuthApi, authRoutes } from "@checkstack/auth-common";

package/src/editor/action-leaf-cards.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Link } from "react-router-dom";
+import { Link } from "react-router";
 import { resolveRoute } from "@checkstack/common";
 import { integrationRoutes } from "@checkstack/integration-common";
 import {

package/src/pages/AutomationEditPage.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Link, useNavigate, useParams, useSearchParams } from "react-router-dom";
+import { Link, useNavigate, useParams, useSearchParams } from "react-router";
 import {
   ChevronLeft,
   History as HistoryIcon,

package/src/pages/AutomationListPage.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Link, useNavigate } from "react-router-dom";
+import { Link, useNavigate } from "react-router";
 import { Workflow, Plus, FlaskConical, Trash2, History } from "lucide-react";
 import {
   usePluginClient,

package/src/pages/AutomationTemplatePickerPage.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { useNavigate } from "react-router-dom";
+import { useNavigate } from "react-router";
 import { Workflow, FilePlus2, ArrowRight } from "lucide-react";
 import {
   usePluginClient,

package/src/pages/RunDetailPage.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Link, useParams } from "react-router-dom";
+import { Link, useParams } from "react-router";
 import {
   CheckCircle2,
   ChevronLeft,

package/src/pages/RunsPage.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Link, useParams, useNavigate } from "react-router-dom";
+import { Link, useParams, useNavigate } from "react-router";
 import { History, ChevronLeft, ArrowUpRight } from "lucide-react";
 import {
   usePluginClient,