Bump @remix-run/router from 1.23.0 to 1.23.2 in /frontend/webcoder_ui by dependabot[bot] · Pull Request #68 · Prekzursil/WebCoder

dependabot · 2026-05-18T22:36:55Z

Bumps @remix-run/router from 1.23.0 to 1.23.2.

Changelog

Sourced from @remix-run/router's changelog.

1.23.2

Patch Changes

Validate redirect locations (#14707)

1.23.1

Patch Changes

Normalize double-slashes in resolvePath (#14537)

Commits

c662ca3 chore: Update version for release (#14713)
98ad691 chore: Update version for release (pre-v6) (#14710)
2fbb84c Validate redirect locations (v6) (#14707)
26b5d45 chore: Update version for release (#14541)
919f8a8 chore: Update version for release (pre-v6) (#14540)
69bf705 Normalize double slashes in resolvePath (#14537)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @remix-run/router since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Upgrade @remix-run/router to 1.23.2 in frontend/webcoder_ui to pull in patch fixes that harden redirects and normalize paths.

Dependencies
- Bump @remix-run/router 1.23.0 → 1.23.2.
- Upstream fixes: validate redirect locations; normalize double slashes in resolvePath.

^{Written for commit 9686f52. Summary will update on new commits. Review in cubic}

Bumps [@remix-run/router](https://github.com/remix-run/react-router/tree/HEAD/packages/router) from 1.23.0 to 1.23.2. - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/@remix-run/router@1.23.2/packages/router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/@remix-run/router@1.23.2/packages/router) --- updated-dependencies: - dependency-name: "@remix-run/router" dependency-version: 1.23.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-18T22:36:56Z

Labels

The following labels could not be found: area:ci, type:chore. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

codeant-ai · 2026-05-18T22:37:01Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

sonarqubecloud · 2026-05-18T22:37:36Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

cubic-dev-ai

No issues found across 1 file

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic}

chatgpt-codex-connector · 2026-05-18T22:38:43Z

💡 Codex Review

WebCoder/frontend/webcoder_ui/package-lock.json

Lines 7506 to 7510 in 9686f52

    
           "node_modules/react-scripts": { 
        
             "version": "0.0.0", 
        
             "resolved": "https://registry.npmjs.org/react-scripts/-/react-scripts-0.0.0.tgz", 
        
             "integrity": "sha512-W7cVfdhbIvYrTjVaryO7WCpvzODu8V7JH/1O36RcfuzP3Cxjp5WpX5ycaoGt0LSQpntrem5jFSUoJrtvru1reA==" 
        
           },

Keep react-scripts locked to the CRA package

With this lockfile, a clean install resolves react-scripts to 0.0.0 even though package.json still requires react-scripts 5.0.1 and its start/build/test scripts invoke that CLI. The previous lock entry contained the CRA dependency tree and react-scripts bin, but this new entry is just the placeholder package, so fresh installs from the committed lockfile will not provide a usable CRA CLI and the frontend build/test commands fail before the app can start.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

socket-security · 2026-05-18T22:41:51Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality	Maintenance
	npm/react-scripts@0.0.0
	npm/https-browserify@1.0.0
	npm/react-router-dom@6.30.3
	npm/process@0.11.10
	npm/stream-browserify@3.0.0
	npm/stream-http@3.2.0
	pypi/brotlipy@0.7.0
	npm/@applitools/eyes-playwright@1.46.3 ⏵ 1.47.2	^-6	⁺¹	⁺¹
	npm/react-hot-toast@2.5.2
	npm/@chromatic-com/playwright@0.12.8 ⏵ 0.14.0	^-1	⁺¹¹	⁺⁸
	npm/url@0.11.4
	npm/crypto-browserify@3.12.1 ⏵ 3.5.1	⁺¹	^-6	^-1
	npm/i18next-browser-languagedetector@7.2.2
	npm/react@18.3.1
	npm/util@0.12.5
	npm/react-syntax-highlighter@16.1.1
	npm/typescript@4.9.5
	npm/i18next@23.16.8
	npm/react-dom@18.3.1
	pypi/azure-servicebus@7.14.3
	npm/web-vitals@2.1.4
	pypi/billiard@4.2.1
	pypi/billiard@4.2.4
	pypi/argcomplete@3.6.3
	npm/react-i18next@13.5.0
	pypi/azure-identity@1.25.3
	pypi/amqp@5.3.1
	pypi/boto3@1.43.10
	pypi/azure-storage-blob@12.29.0
	pypi/azure-storage-queue@12.16.0
	pypi/brotli@1.2.0
	pypi/attrs@26.1.0
	pypi/asgiref@3.8.1
See 4 more rows in the dashboard

View full report

socket-security · 2026-05-18T22:41:53Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: frontend/webcoder_ui/package-lock.json → `npm/crypto-browserify@3.5.1` → `npm/elliptic@0.15.17` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/elliptic@0.15.17`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: npm `sha.js` is missing type checks leading to hash rewind and passing on crafted data CVE: GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data (CRITICAL) Affected versions: < 2.4.12 Patched version: 2.4.12 From: frontend/webcoder_ui/package-lock.json → `npm/crypto-browserify@3.5.1` → `npm/sha.js@2.3.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/sha.js@2.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

codacy-production · 2026-05-18T22:43:59Z

Not up to standards ⛔

🔴 Issues 1 critical · 1 high · 3 medium · 21 minor

Alerts:
⚠ 26 issues (≤ 0 issues of at least minor severity)
⚠ 7 issues (≤ 0 issues of at least minor severity)

Results:
26 new issues

Category Results

Security 2 minor
1 high
1 critical
3 medium

CodeStyle 19 minor

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity ✅ 0 (≤ 10 complexity)

Duplication ✅ 0 (≤ 0 duplication)

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

dependabot Bot added the dependencies Pull requests that update a dependency file label May 18, 2026

cubic-dev-ai Bot reviewed May 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump @remix-run/router from 1.23.0 to 1.23.2 in /frontend/webcoder_ui#68

Bump @remix-run/router from 1.23.0 to 1.23.2 in /frontend/webcoder_ui#68
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/webcoder_ui/remix-run/router-1.23.2

dependabot Bot commented on behalf of github May 18, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

dependabot Bot commented on behalf of github May 18, 2026

Uh oh!

codeant-ai Bot commented May 18, 2026

Uh oh!

sonarqubecloud Bot commented May 18, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

chatgpt-codex-connector Bot commented May 18, 2026

Uh oh!

socket-security Bot commented May 18, 2026

Uh oh!

socket-security Bot commented May 18, 2026

Uh oh!

codacy-production Bot commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 18, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.23.2

Patch Changes

1.23.1

Patch Changes

Summary by cubic

Uh oh!

dependabot Bot commented on behalf of github May 18, 2026

Labels

Uh oh!

codeant-ai Bot commented May 18, 2026

Uh oh!

sonarqubecloud Bot commented May 18, 2026

Quality Gate passed

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented May 18, 2026

💡 Codex Review

Uh oh!

socket-security Bot commented May 18, 2026

Uh oh!

socket-security Bot commented May 18, 2026

Uh oh!

codacy-production Bot commented May 18, 2026

Not up to standards ⛔

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 18, 2026 •

edited by cubic-dev-ai Bot

Loading