react-router@7.18.2 includes the backported fix for GHSA-qwww-vcr4-c8h2, but npm audit still reports it as vulnerable because the advisory currently lists the affected range as >=7.12.0 <8.2.0.
The fix was backported to the 7.x release line and shipped in 7.18.2. Could the affected version range be updated to exclude 7.18.2 (or whatever the correct fixed boundary is)?
This currently results in a false positive from npm audit.
react-router@7.18.2 includes the backported fix for GHSA-qwww-vcr4-c8h2, but npm audit still reports it as vulnerable because the advisory currently lists the affected range as >=7.12.0 <8.2.0.
The fix was backported to the 7.x release line and shipped in 7.18.2. Could the affected version range be updated to exclude 7.18.2 (or whatever the correct fixed boundary is)?
This currently results in a false positive from npm audit.