[Snyk] Security upgrade @primer/react from 36.27.0 to 37.0.0

[JonathanXDR]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-DIFF-14917201	708

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
atom	Error		Jan 23, 2026 5:11am

[Copilot]

Pull request overview

This PR upgrades @primer/react from version 36.27.0 to 37.0.0 to address a Regular Expression Denial of Service (ReDoS) vulnerability (SNYK-JS-DIFF-14917201) with a priority score of 708. The security fix is achieved by removing the vulnerable diff package from the dependency tree.

Changes:

• Upgraded @primer/react from 36.27.0 to 37.0.0 (major version bump)
• Removed several unused transitive dependencies including react-markdown and its entire dependency tree
• Added new dependencies: @prettier/sync, hsluv, and make-synchronized
• Upgraded @primer/primitives from 7.x to 9.x as a transitive dependency

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates @primer/react version from ^36.27.0 to ^37.0.0
package-lock.json	Updates dependency tree for @primer/react 37.0.0, removes markdown-related dependencies, adds prettier as production dependency via @primer/primitives 9.x, and removes the vulnerable diff package

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.