Update dependency react-router-dom to v7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
react-router-dom (source)	^6.30.3 → ^7.0.0

---

React Router: Open redirect leading to XSS

CVE-2026-53668 / GHSA-jjmj-jmhj-qwj2

More information

Details

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
• https://github.com/remix-run/react-router/pull/14718
• https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
• https://github.com/remix-run/react-router
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

remix-run/react-router (react-router-dom)

v7.0.0

Compare Source

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#​11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,

• Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#​11469)

• Remove single fetch future flag. (#​11522)

• Remove future.v7_startTransition flag (#​11696)

• Remove future.v7_normalizeFormMethod future flag (#​11697)

• Allow returning undefined from actions and loaders (#​11680)

• update minimum node version to 18 (#​11690)

• Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#​11726)

• Remove future.v7_throwAbortReason from internalized @remix-run/router package (#​11728)

• Add exports field to all packages (#​11675)

• node package no longer re-exports from react-router (#​11702)

• updates the minimum React version to 18 (#​11689)

• • Remove the future.v7_partialHydration flag (#​11725)
    • This also removes the <RouterProvider fallbackElement> prop
      • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
    • Also worth nothing there is a related breaking changer with this future flag:
      • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
      • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

• Remove future.v7_fetcherPersist flag (#​11731)

Minor Changes

• Add prefetching support to Link/NavLink when using Remix SSR (#​11402)
• Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#​11401)
• Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#​11396) (#​11400)

Patch Changes

• Memoize some RouterProvider internals to reduce uneccesary re-renders (#​11817)
• Updated dependencies:
  • react-router@7.0.0

v6.30.4

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e626840

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR