React Server Components Security PR Automation

This repository provides a script to automatically bump and create pull requests (PRs) for repositories affected by CVE-2025-55182, which affects vulnerable versions of react-server-dom-* and related React packages.

What does this tool do?

• Scans for affected react-server-dom-*, react, react-dom, and next versions in a repository's package.json.
• Bumps them to secure, fixed versions if necessary.
• Creates a PR in the target repository with the updated dependencies.
• Supports both direct repositories and forks.

Why is this needed?

A critical security vulnerability (CVE-2025-55182) has been disclosed in React Server Components and related packages. To help OSS maintainers and teams patch their projects quickly and safely, this script automates the upgrade and PR creation process.

Supported Packages and Fixes

• react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack → Upgraded to 19.2.1
• react, react-dom → Upgraded to 19.2.1
• next:
  • If using canary 14.3.0-canary.77 or above, bumps to 14.1.4
  • 15.x/16.x upgrade to latest patched (16.0.7)

Usage

1. Prerequisites

• Node.js >= 18
• A GitHub personal access token (classic or fine-grained) with repo permissions.
• Octokit (GitHub API SDK for Node.js).

2. Configure and Run

1. Install dependencies:

   root@kitploit:~

   npm install
   

2. Set your GITHUB_TOKEN as an environment variable:

   root@kitploit:~

   export GITHUB_TOKEN=your_token_here
   

3. Edit the repoUrls array in index.ts to list the GitHub repositories you wish to patch.

4. Run the main workflow:

   root@kitploit:~

   npm run dev
   

3. What happens next?

• The script scans each listed repository for vulnerable React-related dependencies.
• If upgrades are needed, it:
  • Creates a new branch.
  • Commits the fixed package.json.
  • Opens a pull request with a descriptive message and link to the CVE disclosure.

Example

See the main() function in index.ts for how to configure the list of repos and run the process.

---

⚠️ Disclaimer

• Always review and test the resulting PRs before merging, especially if you have custom configuration or nonstandard dependency usage.
• This script only bumps pinned versions in the root package.json (monorepos may require customization).
• If you hit rate limits or permission issues, check your GitHub token permissions.

---

References

• React Security Blog Post
• CVE-2025-55182 Details
• Octokit REST.js Docs
• npm audit
• How NPM Version Ranges Work

---

License

MIT License

---

For questions or contributions, please open an issue or PR!