Bump the npm_and_yarn group across 1 directory with 8 updates - #5034
Bump the npm_and_yarn group across 1 directory with 8 updates#5034dependabot[bot] wants to merge 2 commits into
Conversation
Bumps the npm_and_yarn group with 7 updates in the /ui/app directory: | Package | From | To | | --- | --- | --- | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.4` | `7.0.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.18` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.1` | | [nanoid](https://github.com/ai/nanoid) | `3.3.12` | `3.3.18` | | [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.26` | Updates `react-router-dom` from 6.30.4 to 7.0.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.0.0/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.0.0/packages/react-router-dom) Updates `brace-expansion` from 1.1.14 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `immutable` from 5.1.5 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) Updates `js-yaml` from 4.3.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.1) Updates `nanoid` from 3.3.12 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.12...3.3.18) Updates `postcss` from 8.5.15 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.26) Updates `react-router` from 6.30.4 to 7.0.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.0.0/packages/react-router) --- updated-dependencies: - dependency-name: react-router-dom dependency-version: 7.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.0.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates the UI app’s routing dependency to a new major version of react-router-dom.
Changes:
- Bumped
react-router-domfrom6.30.4to7.0.0
Files not reviewed (1)
- ui/app/package-lock.json: Generated file
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
| "react-markdown": "^8.0.3", | ||
| "react-redux": "^8.0.4", | ||
| "react-router-dom": "6.30.4", | ||
| "react-router-dom": "7.0.0", |
| "react-markdown": "^8.0.3", | ||
| "react-redux": "^8.0.4", | ||
| "react-router-dom": "6.30.4", | ||
| "react-router-dom": "7.0.0", |
Unit Test Results241 tests 241 ✅ 27s ⏱️ Results for commit e9f754f. ♻️ This comment has been updated with latest results. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- ui/app/package-lock.json: Generated file
Suppressed comments (2)
ui/app/package.json:25
- This major UI dependency change leaves the UI component version at
0.8.31and has no changelog entry. Bump the UI version according to semantic versioning and document this significant dependency/migration change inCHANGELOG.mdso releases include it.
"react-router-dom": "7.0.0",
ui/app/package.json:25
- React Router 7 enables the v7 relative-splat behavior, but the UI still relies on the v6 behavior inside routes such as
requests/*andusers/*. For example,AirlockNewRequestandWorkspaceUsersAssignNewclose withnavigate("../"); under v7 this resolves against the current splat and can remain on the panel URL, whileAirlockcan appendnavigate("new")to an existing request ID. Migrate these splat routes to the v7 parent/child route structure or use explicit parent targets, and cover the affected open/close navigation flows before taking this major upgrade.
"react-router-dom": "7.0.0",
|
/test-extended |
|
🤖 pr-bot 🤖
(in response to this comment from maxmartin-cgi) |
|
/test-extended e9f754f |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/31588032638 (with refid (in response to this comment from maxmartin-cgi) |
|
maxmartin-cgi as this is UI changes, e2e extended won't test other than it builds. Looks like React 7 upgrade needs to stuff fixing, wonder if is a patch version. |
|
Marcus Robinson (@marrobi) Alright I'll put a pin in this and look at getting it tested properly |
|
Courtesy of @rudolphjacksonm/claude: PR #5034 Dependency Upgrade AssessmentPull request: microsoft/AzureTRE#5034 Executive summaryThe ordinary patch-level transitive updates in this pull request appear safe and require no AzureTRE application changes. The material concern is the direct upgrade of The upgrade should not be merged as currently proposed because:
The recommended approach is to test and correct v7 routing behavior deliberately, then upgrade to a currently patched v7 release rather than 1. Pull request scopeOnly two files change: There are no application-source or test changes. Direct dependency change
Resolved lockfile changes
The React Router upgrade also removes
These are consequences of React Router's package consolidation, not independent application migrations. 2. React Router 6.30.4 to 7.xCompatibility summary
Existing APIs remain source-compatibleAzureTRE uses conventional declarative-router APIs such as:
Representative locations include:
React Router 7 retains No uses were found of migration-sensitive or removed APIs such as:
A broad API rewrite is therefore not required. Runtime prerequisitesReact Router 7 requires:
AzureTRE declares React and React DOM Relevant files: The deployment script uses whichever Node version is installed on its host, so that environment should also be confirmed as Node 20 or newer: Do not target
|
| Starting location/action | Expected result |
|---|---|
/workspaces/W/requests → New request |
/workspaces/W/requests/new |
/workspaces/W/requests/OLD → New request |
/workspaces/W/requests/new, not /OLD/new |
/workspaces/W/requests/OLD → select NEW |
/workspaces/W/requests/NEW, not /OLD/NEW |
/requests/OLD → select NEW |
/requests/NEW, not /OLD/NEW |
| Close workspace Airlock panel | /workspaces/W/requests |
/workspaces/W/users → Assign New |
/workspaces/W/users/new |
| Close assignment panel | /workspaces/W/users |
| Direct entry/refresh of workspace service | Existing route continues to render |
| Direct entry/refresh of user resource | Existing route continues to render |
| Direct entry/refresh of shared service | Existing route continues to render |
Existing tests mock router hooks or test broad rendering but do not establish these URL transitions:
6. Route cleanup
AzureTRE currently declares this route in ui/app/src/App.tsx:112:
path="/workspaces/:workspaceId//*"It should be normalized to:
path="/workspaces/:workspaceId/*"The double slash is pre-existing and appears to have been tolerated, so it is not introduced by this PR. It is nevertheless noncanonical and adds unnecessary ambiguity during a splat-routing migration. Direct navigation and refresh should be tested after changing it.
7. Other dependency bumps
brace-expansion 1.1.14 → 1.1.18 and 2.1.0 → 2.1.4
- Breaking changes: None identified.
- AzureTRE usage: Transitive development/tooling dependency, chiefly below minimatch and ESLint.
- Required changes: None.
These releases contain security/performance hardening around pathological expansion behavior. Keep the updates and run lint normally.
fast-uri 3.1.2 → 3.1.5
- Breaking changes: None identified.
- AzureTRE usage: Transitive URI-validation dependency.
- Required changes: None.
The releases improve URI canonicalization and parsing, including authority delimiters, encoded paths, and internationalized names.
immutable 5.1.5 → 5.1.9
- Breaking changes: None identified.
- AzureTRE usage: Transitive/optional build dependency; no direct imports found.
- Required changes: None.
The patch releases fix sequence iteration, bounds handling, hash-collision behavior, and collection edge cases.
js-yaml 4.3.0 → 4.3.1
- Breaking changes: None documented.
- AzureTRE usage: Transitive tooling/configuration parsing.
- Required changes: None.
Retain the patch and rely on existing lint/build coverage.
nanoid 3.3.12 → 3.3.18
- Breaking changes: None identified.
- AzureTRE usage: Pulled transitively by PostCSS rather than imported by application code.
- Required changes: None.
The updates fix edge cases including zero or negative sizes and random-pool behavior.
postcss 8.5.15 → 8.5.26
- Breaking changes: No public major API break in this patch range.
- AzureTRE usage: Vite/CSS build pipeline; no custom PostCSS calls or configuration identified.
- Required changes: None currently indicated.
- Recommended validation: Production Vite build and a brief CSS/UI smoke test.
This range includes source-map boundary hardening, prototype-manipulation protections, stack-overflow prevention, and formatting/visitor fixes. Custom processors relying on unusual source-map locations or missing opts.from could observe differences, but AzureTRE does not appear to contain such code.
8. Lockfile observations
The lockfile root changes several declarations from "latest" to "*" even though package.json remains unchanged:
@vitejs/plugin-react-swcvite-plugin-svgrvite-tsconfig-pathsjsdom
The actual resolved versions of those packages do not change in this PR. This appears to be npm lockfile serialization rather than a real dependency bump.
No application changes are associated with those lines. Two reproducibility improvements are worth considering separately:
- Generate the lockfile using the repository's agreed npm version.
- Prefer
npm ciovernpm installin CI/deployment when the lockfile is authoritative.
These are maintenance recommendations, not blockers specific to the React Router upgrade.
9. Validation results
The exact PR snapshot was tested in an isolated environment. The generated src/config.json needed by the build was supplied from the tracked source configuration.
| Validation | Result |
|---|---|
npm ci |
Passed |
| TypeScript/Vite production build | Passed |
| Lint | Passed |
| Vitest | 241/241 tests passed across 27 files |
npm audit |
Failed on high-severity findings in the React Router 7.0.0 chain |
The production build emitted only the existing large-bundle warning.
These successful checks establish that:
- the current APIs compile under v7;
- no obvious import or type migration is missing;
- the ordinary lockfile updates do not break the build.
They do not establish that relative navigation resolves correctly under active splat paths.
10. CI status
The visible lint, build, unit-test, CodeQL, and Copilot review checks succeeded.
The extended smoke workflow failed while deploying shared services, specifically during Deploy firewall:
Available public metadata does not indicate that the infrastructure failure was caused by React Router or the lockfile. Downstream E2E jobs were skipped, meaning the workflow did not provide routing confidence.
Action logs requiring repository authentication were not accessible during the review.
11. Copilot comments
React Router major-version migration
Copilot warns that React Router 6 to 7 is a major upgrade and requests corresponding migration changes or justification.
Assessment: valid.
A broad API rewrite is not needed, but the PR currently lacks:
- handling or explicit validation of v7 splat-relative behavior;
- route-location regression tests;
- rationale for selecting the unpatched initial
7.0.0release.
Lockfile not updated
Copilot says that the pinned package update should include an updated lockfile.
Assessment: incorrect/inapplicable.
ui/app/package-lock.json is included and resolves both react-router and react-router-dom to 7.0.0. The comment can be resolved with that clarification.
Suppressed splat-route observation
A later Copilot review identified splat-route navigation as a concern but did not post it as a separate inline discussion.
Assessment: substantively valid.
It corresponds to the v7_relativeSplatPath issue described above.
12. Required and recommended changes
Must be addressed before merge
- Do not merge with
react-router-dom@7.0.0. - Select a currently patched v7 release—
7.18.2at assessment time—and regenerate the lockfile. - Enable and test v7 relative-splat semantics, preferably first on React Router 6.30.4 using future flags.
- Add location-aware tests for Airlock and workspace-user navigation.
- Correct any navigation that appends to the active splat rather than selecting a sibling child.
- Run the complete suite against the final selected React Router version, not just
7.0.0.
Recommended
- Normalize
/workspaces/:workspaceId//*to/workspaces/:workspaceId/*. - Test direct URL entry and refresh for all nested workspace/resource routes.
- Confirm the Node version on deployment agents is at least Node 20.
- Run a CSS/UI smoke test for the PostCSS update.
- Investigate or rerun the failed firewall deployment so browser E2E stages can execute.
- Consider using
npm ciand bounded dependency ranges for more reproducible builds.
No associated code changes needed
- React and React DOM.
- Existing
react-router-domimports. - Declarative
BrowserRouter,Routes,Route,Link,useNavigate,useLocation, anduseParamsusage outside the identified relative-splat cases. - Data-router, loader/action, SSR, hydration, framework-mode, RSC, and Single Fetch features.
brace-expansion,fast-uri,immutable,js-yaml, ornanoid.- PostCSS, based on current usage, beyond build/UI validation.
Final disposition
Request changes / hold the PR.
This is not a case where React Router 7 requires a wholesale source migration: AzureTRE's existing imports and declarative routing model still compile, and all 241 existing tests pass. The problem is narrower but important:
- the PR selects an obsolete, vulnerable v7 release;
- it crosses a known splat-routing behavior boundary;
- AzureTRE contains the relative-navigation patterns affected by that boundary;
- existing tests do not exercise the resulting URLs.
Preserve the ordinary patch-level lockfile upgrades, but revise the React Router portion into a deliberate migration with focused route tests and a patched v7 target.
Bumps the npm_and_yarn group with 7 updates in the /ui/app directory:
6.30.47.0.01.1.141.1.183.1.23.1.55.1.55.1.94.3.04.3.13.3.123.3.188.5.158.5.26Updates
react-router-domfrom 6.30.4 to 7.0.0Changelog
Sourced from react-router-dom's changelog.
... (truncated)
Commits
e8e3b00chore: Update version for release (#12344)1499f3echore: Update version for release (pre) (#12315)995bcbbchore: Update version for release (pre) (#12235)0e9b346chore: Update version for release (pre) (#12205)6576bd0chore: Update version for release (pre) (#12202)8daac72Merge branch 'dev' into release-next2d5924ffeat: configure export conditions properly (#12136)18dc8b8chore: Update version for release (pre) (#12184)fde6951Merge branch 'dev' into release-next813497aDrop support for Node 18 and installGlobals (#12171)Attestation changes
This version has no provenance attestation, while the previous version (6.30.4) was attested. Review the package versions before updating.
Updates
brace-expansionfrom 1.1.14 to 1.1.18Release notes
Sourced from brace-expansion's releases.
Commits
758fcd61.1.1827fbeedMerge commit from fork5c57cc21.1.17d757f1dnpm ignore.claudecb4b9e4fix: backport GHSA-mh99-v99m-4gvg (#129)447763a1.1.16d74e630fix: v1 backport for CVE-2026-13149 (#122)2203f4f1.1.150b09384Backport v5.0.6 change to v1 (#111)Updates
fast-urifrom 3.1.2 to 3.1.5Release notes
Sourced from fast-uri's releases.
Commits
5e179cbBumped v3.1.52cad02dMerge commit from fork6aeece6Bumped v3.1.42d50fbafix: reject literal backslash in URI authority0549fe3Bumped v3.1.32a6d357Merge commit from forkUpdates
immutablefrom 5.1.5 to 5.1.9Release notes
Sourced from immutable's releases.
... (truncated)
Changelog
Sourced from immutable's changelog.
Commits
329f7a65.1.921fabd9changelog009164fMerge pull request #2235 from immutable-js/fix/avoid-null-when-setsize335b65bfbfix(List): preserve undefined values when grown past 32 elements50bf39eUpdate CHANGELOG.md for versions 5.1.8 and 4.3.964965395.1.8808a83aMerge commit from forke51d49fperf(Map): index large hash-collision buckets for faster lookups25c58b0fix typescript in testsa1a1ee4Merge commit from forkUpdates
js-yamlfrom 4.3.0 to 4.3.1Changelog
Sourced from js-yaml's changelog.
Commits
86e91b84.3.1 releasedc3cc4b0Backport quadratic complexity fix for !!omapUpdates
nanoidfrom 3.3.12 to 3.3.18Release notes
Sourced from nanoid's releases.
Changelog
Sourced from nanoid's changelog.
Commits
9ad9805Release 3.3.18 version55e50a0Update CI actione10f8d4Update index.native.js (#606)73d6716Release 3.3.17 versionf9d13f1Sync 0 size behaviour with PostCSS 59760e11Release 3.3.16 versione835c9bfix(non-secure): clamp negative size to prevent infinite loop (#601)96dd086Update CI actionba0bc3bDo not create latest release for v36819724Release 3.3.15 versionMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.
Updates
postcssfrom 8.5.15 to 8.5.26Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
... (truncated)
Commits
07b2577Release 8.5.26 version47de6b9Update CI1493a83Fix Rule#selectors losing the empty selector (#2129)180db16Typo29e9e00Resolve symlinks before the previous-source-map containment check (#2125)3ba8f84Update dependencies87e72f6Update lock filecaaeeb9Upgrade nanoid to fix infinite loop on zero size (#2124)3609b6fExplain how to type plugin optionsfbad419docs: show ESM and TypeScript plugin declaration (#2118)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.
Updates
react-routerfrom 6.30.4 to 7.0.0Release notes
Sourced from react-router's releases.
Changelog
Sourced from react-router's changelog.
... (truncated)
Commits
e8e3b00chore: Update version for release (#12344)1499f3echore: Update version for release (pre) (#12315)fd76ac8Merge branch 'dev' into release-next1217253add export conditions for route module types (#12312)b0e037fun-deprecate types for library mode (#12309)144a89afix types forAwait's render prop (#12298)7d365edmatches as component prop (#12291)7d92685typegen: not ignored by skipLibCheck (#12289)2bd6740Addreact-router.config.ts(#12251)5a7b291typegen:+types.\<route>->+types/\<route>(#12284)Attestation changes
This version has no provenance attestation, while the previous version (6.30.4) was attested. Review the package versions before updating.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.