[daliu]

Closes #192

Outcome

Patch the compatible React Router 6 graph that contains three high-severity audit findings, enable the two declarative-router compatibility flags deliberately, and preserve the club's route/callback behavior without a route redesign.

Reviewed source: 312be3b
Base main: efe82e1

Security boundary

• React Router stays on major 6.
• The direct dependency is pinned at 6.30.4.
• The lock changes only react-router-dom 6.30.4, react-router 6.30.4, and @remix-run/router 1.23.3.
• Existing same-origin callback preservation and hostile-target rejection are untouched.
• No route, Firebase, Functions, Rules, Stripe, workflow, provider, or deploy configuration changes.

Changes

• Pin the coherent advisory-patched router graph.
• Enable v7_startTransition and v7_relativeSplatPath on the production BrowserRouter.
• Enable the same flags in the two existing MemoryRouter test harnesses.
• Add fail-before/pass-after warning coverage, embedded-double-slash normalization coverage, and asynchronous wildcard-to-home navigation coverage.
• Reconcile the narrow engineering security and issue status documents.

Audit evidence

Node 20 production audit before:

• 22 total: 1 critical, 8 high, 12 moderate, 1 low
• Three router entries present

Node 20 production audit after:

• 19 total: 1 critical, 5 high, 12 moderate, 1 low
• No router entry
• Functions production audit remains 9 total, including 1 high; this PR does not claim those findings are safe

The package-lock identity diff contains exactly the three router package nodes.

Verification

• Deliberate pre-fix App regression: failed on React Router future warnings
• Focused App/login/account suite: 45/45 passed
• Complete frontend Jest: 10 suites, 135/135 passed, no Router future warnings
• Standalone SPA callback safety: 10/10 passed
• Non-mutating frontend lint: 102 files, existing reviewed baseline 125 errors / 7 warnings
• Workflow/release/artifact tests: 42/42 passed
• Functions lint: passed
• Functions unit tests: 990 passed / 32 skipped
• Firestore Rules emulator: 317/317 passed
• Commerce command-journal emulator: 31/31 passed
• Node 20 clean lockfile install and exact dependency tree: passed
• Diagnostic optimized build: passed
• Markdown relative links and git diff --check: passed
• Independent security review: approved
• Independent documentation/scope review: approved

Migration and rollback

No data migration. Roll back the package declaration, all three lock records, router flags, tests, and status documentation together if an exact deployment reveals a compatibility regression. Do not partially downgrade one router package.

Officer impact: None — the public route inventory and officer procedures do not change.

Officer documentation: None — dependency and tested router-compatibility patch only.

Deployment evidence: Source and local tests only at PR creation. No website publication, runmprc.com verification, Firebase deployment, Stripe/provider configuration, branch-setting change, or live behavior has occurred. Hosted PR and post-merge evidence will be recorded separately.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	312be3b
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a557323948fb00008375e8f
😎 Deploy Preview	https://deploy-preview-193--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.