[Bug]: react-router-dom v5 uses vulnerable version of path-to-regexp

[stbenjam]

What version of React Router are you using?

v5.2.0

Steps to Reproduce

1. npm install react-router-dom@5.2.0
2. npm audit --production

Expected Behavior

#9637 (comment) makes the bold claim there's no end-of-life for any React router version, although there's not been any updates to v5 in years.

If there's truly no EOL I'd expect to see it move to path-to-regexp version that's not vulnerable (v0.1.10 or 8.0.0 are the only fixed versions).

In some hacky overrides testing, the fixed v0.1.10 seems to work fine for me.

Actual Behavior

Relies on vulnerable path-to-regexp version

npm warn config production Use `--omit=dev` instead.
# npm audit report

path-to-regexp  0.2.0 - 7.2.0
Severity: high
path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
fix available via `npm audit fix --force`
Will install react-router-dom@6.26.2, which is a breaking change
node_modules/path-to-regexp
  react-router  4.0.0-0 - 5.3.4
  Depends on vulnerable versions of path-to-regexp
  node_modules/react-router
    react-router-dom  4.0.0-beta.1 - 5.3.4
    Depends on vulnerable versions of react-router
    node_modules/react-router-dom

3 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

[stbenjam]

Here's the relevant CVE GHSA-9wv6-86v2-598j

[timdorr]

Duplicate of #11975

[timdorr]

Also, you are not affected by this, as you're not using a vulnerable path pattern: https://github.com/openshift/sippy/blob/master/sippy-ng/src/App.js

[stbenjam]

Sure, but we rely on npm audit --production coming back clean. It doesn't mean someone won't implement such a path in the future either.

I guess I could move to https://www.npmjs.com/package/npm-audit-resolver and add an exception...

[alecf]

I've submitted a PR for v5, hoping someone can make an exception for this: #11980

[stephen-risk-first]

FWIW, version 1.9.0 of path-to-regexp has been released recently which fixes the vulnerability and is compatible with the version of path-to-regexp that is required by react-router-dom@5 (which is ^1.7.0).