React Router 8 — Patch GHSA Without RSC Framework Mode
Dependabot flagged react-router-dom 7.18.1 inside GHSA-qwww-vcr4-c8h2 — a CSRF bypass in React Router RSC mode for versions >=7.12.0 and <8.3.0. My portfolio is a Vite SPA with BrowserRouter and client-side Routes. No react-router/rsc imports, no unstable server actions, no framework mode.
The advisory only bites when you use unstable RSC APIs where server actions can run before CSRF rejection. Still, I upgraded to react-router 8.3.0 — one dependency instead of react-router-dom + react-router, and Dependabot goes quiet.
If your app only uses BrowserRouter, Link, useParams, useLocation, and Navigate from a static Vite build, you are not on the RSC action pipeline this CVE targets. A CSRF bypass on server actions is irrelevant when there are no server actions.