microfrontends

The following config should route to

Describe the bug @vercel/microfrontends@2.2.2 depends on , which has a known high-severity ReDoS vulnerability (CVE-2024-45296, GHSA-9wv6-86v2-598j). When users apply the recommended pnpm security override to patch this vulnerability, pnpm resolves it to 8.3.0, which has a breaking API change. This causes Next.js static page generation to fail with on any page using the microfrontends Link component. Steps to reproduce issue 1. Create a Next.js 16 project with @vercel/microfrontends@2.2.2 2. Use the Link component from @vercel/microfrontends/next/client in any page (e.g., not-found.tsx) 3. Run pnpm audit and observe the high-severity vulnerability warning for path-to-regexp 4. Add the recommended override to package.json: 5. Run pnpm install && pnpm build 6. Build fails during static page generation Expected behavior 1. @vercel/microfrontends should ship with path-to-regexp@6.3.0 (the patched version) instead of 6.2.1 (vulnerable) so users don't need to add overrides 2. If users do add a security override, the build should not break Additional context