chore(deps): major bumps — react-router 8, recharts 3, plugin-react 6, jest-dom 7, visualizer 7

[Apexone11]

Clears the last 2 open high-severity alerts (#176, #177 — react-router). Supersedes Dependabot #446–#451.

react-router 7.18.1 → 8.3.0 (the breaking one)

v8 removes the react-router-dom package entirely. In v7 everything DOM-specific had already collapsed into react-router; react-router-dom was kept only as a v6-compat convenience, and v8 drops it.

• Swapped all 225 importing files (src + tests, including vi.mock/vi.importActual targets) to react-router.
• Every symbol this app uses is exported from react-router in v8: BrowserRouter, MemoryRouter, Routes, Route, Link, NavLink, Navigate, useNavigate, useLocation, useParams, useSearchParams, useBlocker.
• The app never used RouterProvider/HydratedRouter (those move to react-router/dom), so there are no other import-path changes.

v8 raises its Node floor to 22.22.0, so:

• frontend engines.node → >=22.22.0
• every workflow's setup-node → 22 (was 20)
• added a root .node-version so Cloudflare Pages builds on 22 rather than defaulting to an older runtime and tripping the engine check — this was the one silent deploy risk in the upgrade.

Breaking changes that do NOT apply here (checked against the v8.0.0 changelog): ESM-only publish, middleware always-on + RouterContextProvider, meta data→loaderData rename, hasErrorBoundary removal, and the future.v8_* flag removals all affect data-router/framework mode. This app is declarative BrowserRouter with no loaders, actions, or meta.

Other majors

Package	From → To
recharts	2.15.4 → 3.10.1
@vitejs/plugin-react	5.1.1 → 6.0.4
@testing-library/jest-dom	6.9.1 → 7.0.0
rollup-plugin-visualizer	6.0.11 → 7.0.1

Validation

• Backend: lint ✅ · build ✅ · tests ✅ 3541 passed
• Frontend: lint ✅ 0 errors · build ✅ (charts + editor chunks build fine on recharts 3 / plugin-react 6) · 906 passed, zero failures
• All three lockfiles regenerated together from a root install; react-router-dom is gone from every lockfile and react-router@8.3.0 is the only entry
• Release-log entry added (CI gate)

After this merges, Dependabot alerts should be at 0. playwright-smoke remains the known-red baseline (red on main since 2026-06-02).

🤖 Generated with Claude Code

Summary by Sourcery

Upgrade routing and frontend tooling dependencies and align Node version requirements across the app and CI.

Bug Fixes:

• Resolve outstanding high-severity dependency alerts related to react-router.

Enhancements:

• Migrate all frontend and test imports from react-router-dom to react-router v8.
• Update recharts, @vitejs/plugin-react, @testing-library/jest-dom, and rollup-plugin-visualizer to their latest major versions.

Build:

• Raise frontend Node engine requirement to >=22.22.0 and add a root .node-version file for consistent runtime selection.

CI:

• Switch all GitHub Actions workflows to use Node 22 for backend, frontend, mobile, nightly, and integrity jobs.

Documentation:

• Add release-log entry documenting the security-focused dependency upgrades and Node version change.

Tests:

• Adjust routing-related tests and mocks to target react-router instead of react-router-dom while keeping coverage intact.

Chores:

• Regenerate root and workspace lockfiles to reflect the new dependency versions and removal of react-router-dom.

[sourcery-ai]

Reviewer's Guide

Upgrades the frontend routing stack to react-router v8 (removing react-router-dom), raises the Node runtime to 22 across the app and CI, and bumps several frontend build/test/charting dependencies, with accompanying lockfile and release-log updates.

File-Level Changes

Change	Details	Files
Migrate all routing imports and mocks from react-router-dom to react-router for react-router v8.	Replace imports of BrowserRouter, MemoryRouter, Routes, Route, Link, NavLink, Navigate, useNavigate, useLocation, useParams, useSearchParams, useBlocker from react-router-dom with react-router. Update Vitest vi.mock/vi.importActual targets to mock react-router instead of react-router-dom. Adjust inline comments that referenced react-router-dom behavior to match react-router v8 naming.	frontend/studyhub-app/src/App.jsx frontend/studyhub-app/src/mobile/App.mobile.jsx frontend/studyhub-app/src/lib/session-context.jsx frontend/studyhub-app/src/pages/sheets/upload/uploadSheetConstants.js frontend/studyhub-app/src/**/*.jsx frontend/studyhub-app/src/**/*.js frontend/studyhub-app/src/**/*.test.jsx
Raise Node runtime requirement to 22.22.0 and align CI workflows and local tooling.	Update frontend package.json engines.node from >=20.0.0 to >=22.22.0. Change actions/setup-node node-version from 20 to 22 in all CI, quality gates, mobile, nightly, and jscrambler workflows. Add a root .node-version file so Cloudflare Pages and other tooling build on Node 22.	frontend/studyhub-app/package.json .github/workflows/ci.yml .github/workflows/quality-gates.yml .github/workflows/mobile-android.yml .github/workflows/nightly-regression.yml .github/workflows/jscrambler-code-integrity.yml .node-version
Bump key frontend dependencies to their latest major versions and regenerate lockfiles.	Update react-router to ^8.3.0 and remove react-router-dom dependency from the frontend app. Upgrade recharts from ^2.15.4 to ^3.10.1. Upgrade @vitejs/plugin-react from ^5.1.1 to ^6.0.4. Upgrade @testing-library/jest-dom from ^6.9.1 to ^7.0.0. Upgrade rollup-plugin-visualizer from ^6.0.11 to ^7.0.1. Regenerate root and frontend package-lock.json files to reflect new dependency graph and removal of react-router-dom.	frontend/studyhub-app/package.json frontend/studyhub-app/package-lock.json package-lock.json
Document the security-related dependency upgrades in the internal release log.	Add a v2.3.0 release-log bullet describing the react-router 7→8.3.0 migration, dependency majors, and Node floor increase. Note that the change clears the last two high-severity Dependabot alerts for react-router.	docs/release-log.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[cloudflare-workers-and-pages]

Deploying studyhub with    Cloudflare Pages

Latest commit:	ae172a0
Status:	✅  Deploy successful!
Preview URL:	https://00bd0ddd.studyhub-2wc.pages.dev
Branch Preview URL:	https://chore-major-deps-2026-08.studyhub-2wc.pages.dev

View logs

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Fixed security issues:

• react-router (link)

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}