react-router

Summary Upgrade axios from 1.6.8 to 1.7.4 to fix CVE-2024-39338. Vulnerability Description: axios: axios: Server-Side Request Forgery Evidence Scanner confirmation: trivy rule flagged this pattern. Production code*: This file is in the production codebase, not test-only code. Threat Model Context This is a web application - XSS and injection vulnerabilities can affect end users. Changes Verification [x] Build passes [x] Scanner re-scan confirms fix [x] LLM code review passed This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation. Automated security fix by OrbisAI Security*

Description can crash when another process runs at the same time. The failure is a filesystem race on : This happens because the dev-server typegen watcher and a standalone invocation both try to remove and rewrite the same generated directories concurrently. Reproduction 1. Start the dev server in a Framework Mode app: 2. While dev is running, trigger typegen from another process (common in real projects): Or run a script that shells out to typegen, e.g.: with a pre-commit hook that also runs before . 3. Repeat a few times or trigger a route-config change in dev while typegen is running. Expected: Both processes complete; generated types stay consistent. Actual: Dev server or typegen crashes with when one process s (or the whole tree) while the other is still writing. Root cause In : and call before writing also calls on route-config changes, which removes There is no cross-process coordination between the Vite plugin watcher and CLI Proposed fix 1. Serialize typegen writes with a cross-process lock outside the generated tree (e.g. ), so dev watcher and CLI typegen cannot overlap destructive writes 2. Retry on retryable errors (, , ) with short backoff before surfacing the error Environment : 8.1.0 Node: >= 22 OS: macOS (also reported on other platforms with parallel file operations) Happy to open a PR with lock + retry if this approach looks good.

The example for navigating with a object places inside the object: But is not a property of (, and is only / / ), so this is a TypeScript excess-property error. At runtime reads from its second argument (), so the above is silently dropped, and is empty on the next page, which is the opposite of what the sentence right below the example promises. This moves into the options argument so the example type-checks and actually populates .