npm audit --omit=dev --audit-level=high has been failing since roughly 2026-07-24. It is not caused by any code change — the last green run on main (2026-07-23) predates these advisories being published. It was accepted as a known-red check when cutting v2.0.0.
What's failing
| Package |
Reached via |
Advisory |
postcss |
autoprefixer, tailwindcss › postcss-nested, vite |
GHSA-r28c-9q8g-f849 — path traversal via sourceMappingURL |
linkify-it |
tiptap-markdown › prosemirror-markdown › markdown-it |
GHSA-22p9-wv53-3rq4 — quadratic scan loop |
linkify-it |
@tiptap/pm › prosemirror-markdown › markdown-it |
GHSA-v245-v573-v5vm — quadratic mailto: validator |
react-router |
react-router-dom |
GHSA-qwww-vcr4-c8h2 — RSC-mode CSRF bypass |
Why it wasn't fixed in the release
There is no in-semver fix. react-router is vulnerable across >=7.12.0 <8.3.0, so every 7.x — including the current latest, 7.18.2 — is affected. I verified this: bumping react-router-dom from the resolved 7.15.1 to 7.18.2 changed nothing, so the bump was reverted rather than shipped as pointless churn. bun update (all within-semver patches) also leaves all four.
Clearing them needs major bumps:
react-router → 8.3.0+, which is a breaking router upgrade@tiptap/* / tiptap-markdown → whatever release pulls a patched markdown-it/linkify-it
Exploitability in Folio specifically
Low, and worth confirming before spending the effort. Folio is a Tauri desktop app using HashRouter with no SSR and no RSC — the React Router advisories describe server-render and RSC action paths the app never executes. postcss is build-time only. The linkify-it DoS needs attacker-controlled markdown, which in Folio means your own transcripts.
Suggested approach
Take the two upgrades independently so a regression is attributable. react-router 8.x first (routing is small: src/App.tsx plus the editor's useParams/useNavigate), then tiptap, checking the note editor and markdown paste carefully. Dependabot already has open branches for both.
npm audit --omit=dev --audit-level=highhas been failing since roughly 2026-07-24. It is not caused by any code change — the last green run onmain(2026-07-23) predates these advisories being published. It was accepted as a known-red check when cutting v2.0.0.What's failing
postcssautoprefixer,tailwindcss › postcss-nested,vitesourceMappingURLlinkify-ittiptap-markdown › prosemirror-markdown › markdown-itlinkify-it@tiptap/pm › prosemirror-markdown › markdown-itmailto:validatorreact-routerreact-router-domWhy it wasn't fixed in the release
There is no in-semver fix.
react-routeris vulnerable across>=7.12.0 <8.3.0, so every 7.x — including the current latest, 7.18.2 — is affected. I verified this: bumpingreact-router-domfrom the resolved 7.15.1 to 7.18.2 changed nothing, so the bump was reverted rather than shipped as pointless churn.bun update(all within-semver patches) also leaves all four.Clearing them needs major bumps:
react-router→ 8.3.0+, which is a breaking router upgrade@tiptap/*/tiptap-markdown→ whatever release pulls a patchedmarkdown-it/linkify-itExploitability in Folio specifically
Low, and worth confirming before spending the effort. Folio is a Tauri desktop app using
HashRouterwith no SSR and no RSC — the React Router advisories describe server-render and RSC action paths the app never executes.postcssis build-time only. Thelinkify-itDoS needs attacker-controlled markdown, which in Folio means your own transcripts.Suggested approach
Take the two upgrades independently so a regression is attributable.
react-router8.x first (routing is small:src/App.tsxplus the editor'suseParams/useNavigate), then tiptap, checking the note editor and markdown paste carefully. Dependabot already has open branches for both.