v1.6.39

[andrebolina]

Summary

• Security updates

Type of change

• New feature
• Bug fix
• Minor change
• Security issue

Validation

• Backend lockfile check: cd backend && uv lock --check
• Backend lint: cd backend && uv run ruff check app tests
• Backend type check: cd backend && uv run mypy
• Backend tests: cd backend && uv run pytest
• Frontend lint: cd frontend && npm run lint
• Frontend tests: cd frontend && npm run test:run
• Frontend build: cd frontend && npm run build

Checklist

• I did not include secrets or private data.
• I added/updated tests for behavior changes.
• I updated version in VERSION, CHANGELOG.md, and README.md.
• I updated docs where needed.

[Copilot]

Pull request overview

This PR bumps PeerHub to release v1.6.39 and applies frontend dependency updates intended as security maintenance, along with the usual version/documentation updates for a release.

Changes:

• Bump app version references to 1.6.39 (VERSION file + README badge) and add a 1.6.39 changelog entry.
• Update frontend dependency react-router from ^7.15.0 to ^8.3.0 and refresh the lockfile accordingly.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
VERSION	Updates the published version to 1.6.39.
README.md	Updates the README version badge to 1.6.39.
CHANGELOG.md	Adds the 1.6.39 release section noting a security update.
frontend/package.json	Bumps react-router to ^8.3.0.
frontend/package-lock.json	Lockfile updates reflecting the dependency bump (including updated engine/peer constraints).

Files not reviewed (1)

• frontend/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

Comments suppressed due to low confidence (1)

frontend/package.json:28

• After upgrading to react-router@8, keeping @types/react-router (which targets older major versions) is likely to provide incorrect/duplicate typings. react-router ships its own TypeScript types, so this @types package should typically be removed to avoid type conflicts.

    "react-router": "^8.3.0",

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

Comments suppressed due to low confidence (2)

frontend/package.json:28

• react-router@^8.3.0 declares peer requirements for react/react-dom >=19.2.7, but package.json currently allows older versions via ^19.1.0, which can lead to peer dependency warnings or failed installs if a resolver picks 19.1.x. Also, @types/react-router is pinned to v5-era types and is very likely incompatible with react-router v8; react-router ships its own types, so keeping this package can cause incorrect typing.

    "react": "^19.1.0",
    "react-dom": "^19.1.0",
    "react-router": "^8.3.0",

.github/workflows/ci.yml:60

• CI now uses node-version: "lts/*" which can drift over time. Since react-router@8.3.0 has an explicit engines requirement of Node >=22.22.0 (per package-lock.json), pinning the CI Node version to at least that minimum will avoid future CI breakage and makes the runtime requirement explicit.

        with:
          node-version: "lts/*"
          check-latest: true
          cache: npm
          cache-dependency-path: frontend/package-lock.json