[Cycode] Fix for vulnerable manifest file dependency - react-router-dom updated to version 6.30.4

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
ui/explore/package.json	1

📂 ui/explore/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
react-router-dom	6.30.1	6.30.4

Warning

Lock file generation failed for one or more manifest files in this pull request. Please regenerate the lock file manually before merging.

---

Note

Low Risk
Patch-level devDependency bump only; lockfile should be refreshed manually before merge.

Overview
Bumps the react-router-dom devDependency in ui/explore/package.json from ^6.30.1 to ^6.30.4 to address a reported vulnerable dependency (Cycode).

No application code changes. Regenerate the explore package lockfile before merge—the PR notes lockfile generation failed in automation.

^{Reviewed by Cursor Bugbot for commit 959a19a. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 959a19a. Configure here.}

[cursor]

Lockfile leaves dependency unfixed

High Severity

react-router-dom is bumped to ^6.30.4 in ui/explore/package.json, but ui/package-lock.json still records explore’s requirement as ^6.30.1 and resolves node_modules/react-router-dom to 6.30.1. Installs via npm ci stay on the vulnerable version (or fail as out of sync), so this change does not remediate the advisory. The production consumer @perses-dev/app also still declares ^6.30.1.

 

^{Reviewed by Cursor Bugbot for commit 959a19a. Configure here.}