Skip to content

Conversation

@ErlendS
Copy link
Contributor

@ErlendS ErlendS commented Dec 10, 2025

Updates compression package to v1.8.1 so its sub-dependency on-headers gets updated to v1.1.0 to fix its security vulnerability.

Additional info

Versions <1.1.0 of on-headers are vulnerable to http response header manipulation:
GHSA-76c9-3jph-rj3q

Looking at compression's changelog for v1.8.0, I see no changes that should require updates in react-router.

Ran pnpm test from root and all tests still pass ✅

@changeset-bot
Copy link

changeset-bot bot commented Dec 10, 2025

🦋 Changeset detected

Latest commit: 12bde17

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages
Name Type
@react-router/serve Patch
@react-router/dev Patch
@react-router/fs-routes Patch
@react-router/remix-routes-option-adapter Patch
create-react-router Patch
react-router Patch
react-router-dom Patch
@react-router/architect Patch
@react-router/cloudflare Patch
@react-router/express Patch
@react-router/node Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@remix-cla-bot
Copy link
Contributor

remix-cla-bot bot commented Dec 10, 2025

Hi @ErlendS,

Welcome, and thank you for contributing to React Router!

Before we consider your pull request, we ask that you sign our Contributor License Agreement (CLA). We require this only once.

You may review the CLA and sign it by adding your name to contributors.yml.

Once the CLA is signed, the CLA Signed label will be added to the pull request.

If you have already signed the CLA and received this response in error, or if you have any questions, please contact us at [email protected].

Thanks!

- The Remix team

@remix-cla-bot
Copy link
Contributor

remix-cla-bot bot commented Dec 10, 2025

Thank you for signing the Contributor License Agreement. Let's get this merged! 🥳

@brophdawg11
Copy link
Contributor

Thanks! I noticed that morgan also had the same on-headers update (link), so I updated that and a few more places where we have compression as a dep (playgrounds, etc)

@brophdawg11 brophdawg11 self-assigned this Dec 10, 2025
@brophdawg11 brophdawg11 added dependencies Pull requests that update a dependency file pkg:@react-router/serve labels Dec 10, 2025
@ErlendS
Copy link
Contributor Author

ErlendS commented Dec 10, 2025

Great! Thanks for jumping on this so quick!

@brophdawg11 brophdawg11 merged commit 37fe291 into remix-run:dev Dec 10, 2025
7 of 8 checks passed
@brophdawg11 brophdawg11 removed their assignment Dec 10, 2025
@brophdawg11 brophdawg11 added the awaiting release This issue has been fixed and will be released soon label Dec 10, 2025
@github-actions
Copy link
Contributor

🤖 Hello there,

We just published version 7.11.0-pre.0 which includes this pull request. If you'd like to take it for a test run please try it out and let us know what you think!

Thanks!

@github-actions
Copy link
Contributor

🤖 Hello there,

We just published version 7.11.0 which includes this pull request. If you'd like to take it for a test run please try it out and let us know what you think!

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting release This issue has been fixed and will be released soon CLA Signed dependencies Pull requests that update a dependency file pkg:@react-router/serve

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants