With droughts now laying bare buried WW2 munitions (shells/bombs/grenades) in rivers, how long can such ordnance remain dangerous?

Sadly, the answer is… it depends.
If for some reason the casing was breached by rusting or impact damage and water was able to leak inside there is a high probability the explosive has been neutralized. But if the device was sealed properly by a competent manufacturer, as per the specifications there is no reason it cannot work 100+ years from now.

I personally have fired some 7.35×51 Curcano ammunition built in the late 1930s and it worked flawlessly even after 70 years. Of course it was stored in a dry area.
Fortunately most modern weaponry has an “expiration date” due to the intentional addition of some form of destabilizing element. But even that is on the order of 20 years.

In one of my chemistry classes we were asked to design an experimental process that would take basic gunpowder and break it down into its component parts using solution, precipitate, evaporation, etc.
I doubt that anyone on the plant has ever done it. It was way quicker and more fun to detonate.

Depending on the design, it can be potentially volatile for much longer than that.

A long time. They are still finding Japanese mines in the Pacific Ocean that have been around for 70 years, that can/will blow up if hit.

Also recently a German bomb used in the Blitz: article from January 22

Here is an article about a 75 year old German “mine” exploding under a fishing vessel in the North Sea on Dec 15, 2020. Subsea explosion

Those mines were well built.

With fairly modern explosives, which use dynamite, or C-4, the nitro glycerin can separate out of the material used to contain it safely and render the bomb very dangerous if moved or jolted.
A big difference from the days when black powder was used.

Another variable would be complexity of the detonation devices and the ability possible corrosive properties of weakest links, like springs, and other pieces that would arm or render useless things such devices…

Good to see you @MrGrimm888