fix(ci): clear cryptography + react-router CVEs blocking Test & Deploy (#538)

.github/workflows/deploy.yml

@@ -53,9 +53,25 @@ jobs:
       # the advisory DB counts.  When a CVE shows up with no fix
       # yet, add ``--ignore-vuln <PYSEC-ID>`` here with a comment
       # citing the upstream issue and the date we plan to revisit.
+      #
+      # cryptography 48.0.1 — three CVEs that are currently UNFIXABLE.
+      # The latest clerk-backend-api (6.0.1) pins
+      # `cryptography>=45.0.0,<49.0.0`, so versions ≥49.0.0 — the fix
+      # for all three — make the dep tree unsatisfiable.  No clerk
+      # release permits cryptography 49+ as of 2026-08-03.  Ignored
+      # until clerk-backend-api raises its cryptography cap past 50.0.0.
+      #   - CVE-2026-69248 (fix 49.0.0)
+      #   - CVE-2026-69249 (fix 49.0.0)
+      #   - CVE-2026-69247 (fix 50.0.0)
+      # Revisit: when clerk-backend-api > 6.0.1 ships, drop these
+      # ignores and bump the constraint-dependencies entry to >=50.0.0.
       - name: Dependency scan (pip-audit)
         working-directory: backend
-        run: uv run pip-audit --strict
+        run: |
+          uv run pip-audit --strict \
+            --ignore-vuln CVE-2026-69248 \
+            --ignore-vuln CVE-2026-69249 \
+            --ignore-vuln CVE-2026-69247
 
       - name: Run tests
         working-directory: backend

.github/workflows/weekly-deps-refresh.yml

@@ -60,9 +60,17 @@ jobs:
       - name: Lint with ruff
         working-directory: backend
         run: uv run ruff check
+      # cryptography 48.0.1 — three CVEs currently UNFIXABLE: clerk-backend-api
+      # 6.0.1 caps cryptography<49.0.0, so ≥49.0.0 (the fix for all three)
+      # makes the tree unsatisfiable.  Mirrors deploy.yml's ignore list;
+      # drop both when clerk-backend-api raises its cap past 50.0.0.
       - name: Backend dependency scan (pip-audit --strict)
         working-directory: backend
-        run: uv run pip-audit --strict
+        run: |
+          uv run pip-audit --strict \
+            --ignore-vuln CVE-2026-69248 \
+            --ignore-vuln CVE-2026-69249 \
+            --ignore-vuln CVE-2026-69247
       - name: Backend tests
         working-directory: backend
         run: uv run pytest -q

frontend/package.json

@@ -22,7 +22,7 @@
     "hls.js": "^1.6.16",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
-    "react-router-dom": "^7.18.1"
+    "react-router": "8.3.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",

frontend/src/App.jsx

@@ -1,5 +1,5 @@
 import { lazy, Suspense, useEffect } from "react"
-import { Routes, Route, Navigate, useNavigate } from "react-router-dom"
+import { Routes, Route, Navigate, useNavigate } from "react-router"
 import { useAuth, useClerk, useOrganization, CreateOrganization } from "@clerk/clerk-react"
 import Layout from "./components/Layout.jsx"
 import LoadingSpinner from "./components/LoadingSpinner.jsx"

frontend/src/components/AppSidebar.jsx

@@ -1,4 +1,4 @@
-import { Link, useLocation } from "react-router-dom"
+import { Link, useLocation } from "react-router"
 import { useOrganization } from "@clerk/clerk-react"
 import { usePlanInfo } from "../hooks/usePlanInfo.jsx"
 

frontend/src/components/CookieNotice.jsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 
 // Lightweight, dismissible cookie NOTICE — not a consent-management
 // platform. We only set strictly-necessary authentication-session

frontend/src/components/HeartbeatBanner.jsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useCallback, useRef } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { useAuth, useOrganization } from "@clerk/clerk-react"
 import { getNode } from "../services/api"
 

frontend/src/components/Layout.jsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react"
-import { Outlet, Link, useLocation } from "react-router-dom"
+import { Outlet, Link, useLocation } from "react-router"
 import { SignedIn, SignedOut, UserButton, OrganizationSwitcher, useOrganization } from "@clerk/clerk-react"
 import { usePlanInfo } from "../hooks/usePlanInfo.jsx"
 import AppSidebar from "./AppSidebar.jsx"

frontend/src/components/NotificationBell.jsx

@@ -1,5 +1,5 @@
 import { useEffect, useRef, useState } from "react"
-import { useNavigate } from "react-router-dom"
+import { useNavigate } from "react-router"
 import { useNotifications } from "../hooks/useNotifications.jsx"
 
 /**

frontend/src/components/UpgradeModal.jsx

@@ -1,4 +1,4 @@
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 
 const UPGRADE_MESSAGES = {
   nodes: {

frontend/src/components/WelcomeHero.jsx

@@ -1,5 +1,5 @@
 import { useState } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { useAuth } from "@clerk/clerk-react"
 import InstallCameraNodeCard from "./InstallCameraNodeCard.jsx"
 import { LogoMark } from "./Logo.jsx"

frontend/src/main.jsx

@@ -19,7 +19,7 @@
 import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
 import { ClerkProvider } from "@clerk/clerk-react"
-import { BrowserRouter } from "react-router-dom"
+import { BrowserRouter } from "react-router"
 import './index.css'
 import App from './App.jsx'
 import { ToastProvider } from './hooks/useToasts.jsx'

frontend/src/pages/AdminPage.jsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useRef } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { useAuth, useOrganization } from "@clerk/clerk-react"
 import { getStreamLogs, getStreamStats, getCameras, getMcpLogs, getMcpLogStats, downloadStreamLogsCsv, downloadMcpLogsCsv } from "../services/api"
 import { useToasts } from "../hooks/useToasts.jsx"

frontend/src/pages/DashboardPage.jsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useCallback, useMemo, useRef } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { useAuth, useOrganization } from "@clerk/clerk-react"
 import { getCameras, getCameraGroups } from "../services/api"
 import { useToasts } from "../hooks/useToasts.jsx"

frontend/src/pages/IncidentsPage.jsx

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useState } from "react"
-import { useNavigate, useParams } from "react-router-dom"
+import { useNavigate, useParams } from "react-router"
 import { useAuth, useOrganization } from "@clerk/clerk-react"
 
 import { getIncidents, getIncidentCounts } from "../services/api"

frontend/src/pages/McpPage.jsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useRef } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { useAuth, useOrganization } from "@clerk/clerk-react"
 import {
   getMcpKeys, createMcpKey, revokeMcpKey,

frontend/src/pages/SettingsPage.jsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useRef } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { useAuth, useOrganization } from "@clerk/clerk-react"
 import { getNodes, createNode as createNodeApi, rotateNodeKey, deleteNode as deleteNodeApi, wipeStreamLogs, fullReset, getSettings, updateNotificationSettings, updateOrgTimezone, getCameras, getEmailPreferences, updateEmailPreferences, downloadGdprExport, getCameraGroups, createCameraGroup, deleteCameraGroup } from "../services/api"
 import { useToasts } from "../hooks/useToasts.jsx"

frontend/src/pages/SignInPage.jsx

@@ -1,5 +1,5 @@
 import { SignIn } from "@clerk/clerk-react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { LogoMark } from "../components/Logo.jsx"
 
 function SignInPage() {

frontend/src/pages/SignUpPage.jsx

@@ -1,5 +1,5 @@
 import { SignUp } from "@clerk/clerk-react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 import { LogoMark } from "../components/Logo.jsx"
 
 function SignUpPage() {

frontend/tests/components/UpgradeModal.test.jsx

@@ -5,14 +5,14 @@
 // PLAN_LIMITS — that's the bug we just fixed in commit 9ac7e8d. These
 // tests pin the current numbers so the next drift fails CI loudly.
 //
-// UpgradeModal uses <Link> from react-router-dom, so we wrap renders in
+// UpgradeModal uses <Link> from react-router, so we wrap renders in
 // <MemoryRouter>. It does NOT use Clerk hooks directly — it just receives
 // `currentPlan` as a prop — so no Clerk mocking is needed.
 
 import { describe, it, expect, vi } from 'vitest'
 import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import { MemoryRouter } from 'react-router-dom'
+import { MemoryRouter } from 'react-router'
 
 import UpgradeModal from '../../src/components/UpgradeModal.jsx'
 

frontend/tests/pages/IncidentsPage.test.jsx

@@ -14,7 +14,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { act, render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import { MemoryRouter, Route, Routes } from 'react-router-dom'
+import { MemoryRouter, Route, Routes } from 'react-router'
 
 // ── Mocks (must come before importing the page) ──────────────────
 

frontend/tests/pages/SettingsPage.cameraGroups.test.jsx

@@ -14,7 +14,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import { MemoryRouter } from 'react-router-dom'
+import { MemoryRouter } from 'react-router'
 
 // ── Mocks (must come before importing the page) ──────────────────