[cursor]

Description

Vanta reports four open findings on the javascript repository. This PR fixes the one with a compatible release.

examples/guide-example is the only direct react-router dependency. It requested ^7.6.3, which resolved to 7.18.5. Aikido Intel marks 7.7.0 through 8.5.0 affected by AIKIDO-2026-887720: createRequestHandler called decodeURI on the request path without a guard, so a malformed percent-encoding threw URIError. 8.5.1 catches that error and falls back to the raw path. There is no 7.x release after 7.18.5.

The example uses declarative mode (BrowserRouter, Routes, Route, Link), which 8.5.1 still exports from react-router. It already resolves React and React DOM to 19.3.1, which meets the 8.5.1 peer requirement of 19.2.7. The lockfile now resolves react-router@^8.5.1 to 8.5.1 and drops cookie@1.0.2 and set-cookie-parser@2.7.3, which only the 7.18.5 copy required.

Linear: https://linear.app/knock/issue/KNO-16746/js-upgrade-react-router-from-7185-to-851

Addressed

• AIKIDO-2026-887720 (low) — react-router 7.18.5 → 8.5.1 — remediate by 2026-12-25 — KNO-16746 — Aikido

Still open, no compatible release

These stay on their triage tickets. Each patched release is a breaking major for the packages that request the current range.

• CVE-2026-118773 (low) — glob 13.0.7, fix recorded as 14.0.2 — KNO-16489
• CVE-2026-118764 (medium) — minimatch 9.0.9, fix recorded as 11.0.1 — KNO-16440
• AIKIDO-2026-922647 (low) — yargs 17.7.2, fix is yargs 18.1+ and 18 is ESM-only — KNO-16335

Todos

None.

Checklist

• Tests have been added for new features or major refactors to existing features.

No SDK behavior changed. The guide example's existing react-router imports typecheck against 8.5.1, and those exports load from the installed package.

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4953ffc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[linear-code]

KNO-16746

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
javascript-ms-teams-connect-example	Ready	Preview	Nov 10, 2026 12:12pm UTC
javascript-nextjs-example	Ready	Preview	Nov 10, 2026 12:12pm UTC
javascript-slack-connect-example	Ready	Preview	Nov 10, 2026 12:12pm UTC
javascript-slack-kit-example	Ready	Preview	Nov 10, 2026 12:12pm UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.48%. Comparing base (7bc6b68) to head (4953ffc).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1121   +/-   ##
=======================================
  Coverage   78.48%   78.48%           
=======================================
  Files         140      140           
  Lines        4508     4508           
  Branches     1314     1314           
=======================================
  Hits         3538     3538           
  Misses        873      873           
  Partials       97       97           

[cursor]

Could not approve because GitHub blocks self-approval on this bot-authored PR. The change is a dependency update (react-router 8.5.1) with green CI, so human approval is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: SDK approver}