Track Dependabot alerts with no fix available yet (react-router v7, deepmerge, elliptic, uuid@3) #422

Tracks Dependabot alerts in this repo that we can't fix right now. They were split out from #403, which covers the alerts that can be fixed now. These alerts are dismissed as tolerable risk with a link back here, so Dependabot stops opening failing updates. Reopen each alert when its fix becomes possible.

react-router (medium): needs a v6 → v7 migration

• Alerts: test: establish dashboard plugin regression baseline #372, AppGraph hard-codes Applications.Core/* type literals, so Radius.Core resources take different layout paths #373 (packages/app/package.json), chore(deps): bump the javascript-deps group with 11 updates #390, ci(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the github-actions group #392 (yarn.lock)
• Advisories: GHSA-337j-9hxr-rhxg, GHSA-wrjc-x8rr-h8h6
• Affected: react-router / react-router-dom 6.30.6. Fixed in 7.18.0.
• Blocker: Backstage packages still expect react-router-dom ^6. Upgrading needs a react-router 7 migration of packages/app, which should follow Backstage's support for v7.
• To do: check whether the advisories apply to our client-side SPA, and plan the v7 migration.

deepmerge (low): no patched version yet

• Alert: #527, GHSA-gcqx-w48m-w2h4 (affects >= 4.2.0, <= 4.3.1)
• Pulled in by @rollup/plugin-node-resolve, fork-ts-checker-webpack-plugin and jest-config (build and test tools only).

elliptic (low): no patched version yet

• Alert: Bump cipher-base from 1.0.4 to 1.0.6 #154, GHSA-848j-6mx2-7j84 (affects <= 6.6.1)
• Pulled in by create-ecdh and browserify-sign (browserify crypto polyfills).

uuid@3 (medium): blocked on Backstage's material-table dependency

• Alert: chore(deps): bump node-gyp from 13.0.0 to 13.0.1 in the javascript-deps group #319 (yarn.lock, affects < 11.1.1). fix(deps): resolve open Dependabot alerts (undici, msal-node, prismjs, esbuild, octokit, uuid) #423 moves the uuid ^8 and ^9 ranges to 11.1.1, but uuid@3.4.0 remains.
• Pulled in by @material-table/core@3 via @backstage/core-components. It calls _interopRequireDefault(require("uuid")).default.v4(), which breaks on uuid 11's ESM-interop build because there is no default export, so a resolution isn't safe.
• material-table only calls v4() without a buffer argument, which the advisory doesn't concern.
• To do: remove this dependency once Backstage drops @material-table/core or moves it to a uuid version >= 11.1.1. Until then, dismiss alert chore(deps): bump node-gyp from 13.0.0 to 13.0.1 in the javascript-deps group #319 as tolerable risk with a link here.

Done when

• react-router upgraded to >= 7.18.0, or the advisories confirmed not to apply
• deepmerge updated once a patched release is out
• elliptic updated once a patched release is out (or the polyfill dependency removed)
• uuid@3 removed from the tree (Backstage drops @material-table/core or moves it to uuid >= 11.1.1)