chore(deps): update all non-major dependencies (examples, templates & patterns) (minor) (#8820)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@react-router/dev](https://reactrouter.com)
([source](https://redirect.github.com/remix-run/react-router/tree/HEAD/packages/react-router-dev))
| [`8.2.0` →
`8.3.0`](https://renovatebot.com/diffs/npm/@react-router%2fdev/8.2.0/8.3.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@react-router%2fdev/8.3.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@react-router%2fdev/8.2.0/8.3.0?slim=true)
|
|
[@react-router/node](https://redirect.github.com/remix-run/react-router)
([source](https://redirect.github.com/remix-run/react-router/tree/HEAD/packages/react-router-node))
| [`8.2.0` →
`8.3.0`](https://renovatebot.com/diffs/npm/@react-router%2fnode/8.2.0/8.3.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@react-router%2fnode/8.3.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@react-router%2fnode/8.2.0/8.3.0?slim=true)
|
|
[@react-router/serve](https://redirect.github.com/remix-run/react-router)
([source](https://redirect.github.com/remix-run/react-router/tree/HEAD/packages/react-router-serve))
| [`8.2.0` →
`8.3.0`](https://renovatebot.com/diffs/npm/@react-router%2fserve/8.2.0/8.3.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@react-router%2fserve/8.3.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@react-router%2fserve/8.2.0/8.3.0?slim=true)
|
| [cypress](https://cypress.io)
([source](https://redirect.github.com/cypress-io/cypress)) | [`15.18.1`
→ `15.19.0`](https://renovatebot.com/diffs/npm/cypress/15.18.1/15.19.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/cypress/15.19.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/cypress/15.18.1/15.19.0?slim=true)
|
| [react-router](https://redirect.github.com/remix-run/react-router)
([source](https://redirect.github.com/remix-run/react-router/tree/HEAD/packages/react-router))
| [`8.2.0` →
`8.3.0`](https://renovatebot.com/diffs/npm/react-router/8.2.0/8.3.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/react-router/8.3.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-router/8.2.0/8.3.0?slim=true)
|
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
| [`8.64.0` →
`8.65.0`](https://renovatebot.com/diffs/npm/typescript-eslint/8.64.0/8.65.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/typescript-eslint/8.65.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/typescript-eslint/8.64.0/8.65.0?slim=true)
|

---

### Release Notes

<details>
<summary>remix-run/react-router (@&#8203;react-router/dev)</summary>

###
[`v8.3.0`](https://redirect.github.com/remix-run/react-router/blob/HEAD/packages/react-router-dev/CHANGELOG.md#v830)

[Compare
Source](https://redirect.github.com/remix-run/react-router/compare/@react-router/dev@8.2.0...@react-router/dev@8.3.0)

##### Minor Changes

- Restart `react-router dev` with `--conditions=development` when not
already configured
([#&#8203;15291](https://redirect.github.com/remix-run/react-router/pull/15291))

##### Patch Changes

- Allow `typescript@7` to be used
([#&#8203;15317](https://redirect.github.com/remix-run/react-router/pull/15317))

##### Unstable Changes

⚠️ *[Unstable
features](https://reactrouter.com/community/api-development-strategy#unstable-flags)
are not recommended for production use*

- Add `unstable_rsc/client-version` client build version virtual module
([#&#8203;15318](https://redirect.github.com/remix-run/react-router/pull/15318))

- Support the `subResourceIntegrity` config option in RSC Framework Mode
([#&#8203;15321](https://redirect.github.com/remix-run/react-router/pull/15321))

##### Migration guide

No changes are required when using the default RSC SSR entry. If you
maintain a custom `app/entry.ssr.tsx`, import the new virtual module and
pass its hashes to React's `importMap` render option:

```diff
+import subResourceIntegrity from "virtual:react-router/unstable_rsc/subresource-integrity";

return renderToReadableStream(<RSCStaticRouter getPayload={getPayload} />, {
  ...options,
  bootstrapScriptContent,
  formState,
+ importMap: subResourceIntegrity
+   ? { integrity: subResourceIntegrity }
+   : undefined,
  signal: request.signal,
});
```

- Updated dependencies:
-
[`react-router@8.3.0`](https://redirect.github.com/remix-run/react-router/releases/tag/react-router@8.3.0)
-
[`@react-router/node@8.3.0`](https://redirect.github.com/remix-run/react-router/releases/tag/@&#8203;react-router/node@8.3.0)
-
[`@react-router/serve@8.3.0`](https://redirect.github.com/remix-run/react-router/releases/tag/@&#8203;react-router/serve@8.3.0)

</details>

<details>
<summary>remix-run/react-router (@&#8203;react-router/node)</summary>

###
[`v8.3.0`](https://redirect.github.com/remix-run/react-router/blob/HEAD/packages/react-router-node/CHANGELOG.md#v830)

[Compare
Source](https://redirect.github.com/remix-run/react-router/compare/@react-router/node@8.2.0...@react-router/node@8.3.0)

##### Patch Changes

- Allow `typescript@7` to be used
([#&#8203;15317](https://redirect.github.com/remix-run/react-router/pull/15317))
- Updated dependencies:
-
[`react-router@8.3.0`](https://redirect.github.com/remix-run/react-router/releases/tag/react-router@8.3.0)

</details>

<details>
<summary>remix-run/react-router (@&#8203;react-router/serve)</summary>

###
[`v8.3.0`](https://redirect.github.com/remix-run/react-router/blob/HEAD/packages/react-router-serve/CHANGELOG.md#v830)

[Compare
Source](https://redirect.github.com/remix-run/react-router/compare/@react-router/serve@8.2.0...@react-router/serve@8.3.0)

##### Patch Changes

- Updated dependencies:
-
[`react-router@8.3.0`](https://redirect.github.com/remix-run/react-router/releases/tag/react-router@8.3.0)
-
[`@react-router/express@8.3.0`](https://redirect.github.com/remix-run/react-router/releases/tag/@&#8203;react-router/express@8.3.0)
-
[`@react-router/node@8.3.0`](https://redirect.github.com/remix-run/react-router/releases/tag/@&#8203;react-router/node@8.3.0)

</details>

<details>
<summary>cypress-io/cypress (cypress)</summary>

###
[`v15.19.0`](https://redirect.github.com/cypress-io/cypress/releases/tag/v15.19.0)

[Compare
Source](https://redirect.github.com/cypress-io/cypress/compare/v15.18.1...v15.19.0)

Changelog: <https://docs.cypress.io/app/references/changelog#15-19-0>

</details>

<details>
<summary>remix-run/react-router (react-router)</summary>

###
[`v8.3.0`](https://redirect.github.com/remix-run/react-router/blob/HEAD/packages/react-router/CHANGELOG.md#v830)

[Compare
Source](https://redirect.github.com/remix-run/react-router/compare/react-router@8.2.0...react-router@8.3.0)

##### Patch Changes

- Encode path params in `href`/`generatePath` per RFC 3986 path-segment
rules instead of `encodeURIComponent`
([#&#8203;15310](https://redirect.github.com/remix-run/react-router/pull/15310))
- Characters that are valid literally in a path segment (`$ & + , ; = :
@&#8203;` — RFC 3986 `pchar`) are no longer percent-encoded, so values
like a semver build `1.0.0+1` interpolate unchanged instead of becoming
`1.0.0%2B1`
- Structural/unsafe characters (`/ ? # %`, whitespace, non-ASCII) are
still escaped exactly as before
- Use `crypto.randomUUID()` for `createMemorySessionStorage` session ids
([#&#8203;15302](https://redirect.github.com/remix-run/react-router/pull/15302))
- `createMemorySessionStorage` is only intended for local development
and testing - sessions are lost when the server restarts
- Fix `NavLink` not applying its `pending` state when `to` has a
trailing slash
([#&#8203;15300](https://redirect.github.com/remix-run/react-router/pull/15300))
- Preserve RSC route component metadata so routes with a `clientLoader`
can skip unnecessary server requests once their components have rendered
while still fetching missing server-rendered elements
([#&#8203;15323](https://redirect.github.com/remix-run/react-router/pull/15323))
- Harden RSC CSRF code paths
([#&#8203;15311](https://redirect.github.com/remix-run/react-router/pull/15311))
- Fix server crash (`TypeError: Invalid state: Unable to enqueue`) when
a request is aborted while the RSC HTML stream has a pending flush
([#&#8203;15286](https://redirect.github.com/remix-run/react-router/pull/15286))
- Handle cancellation of the `injectRSCPayload` readable side, clear the
pending flush, and cancel the underlying RSC payload stream

##### Unstable Changes

⚠️ *[Unstable
features](https://reactrouter.com/community/api-development-strategy#unstable-flags)
are not recommended for production use*

- Detect stale RSC clients during lazy route discovery and reload the
destination document
([#&#8203;15318](https://redirect.github.com/remix-run/react-router/pull/15318))

##### Migration

Apps using the default RSC Framework entry do not need to make any
changes. Apps with a custom `entry.rsc.tsx` should import the generated
client version and pass it to `unstable_matchRSCServerRequest`:

```tsx
import clientVersion from "virtual:react-router/unstable_rsc/client-version";

return unstable_matchRSCServerRequest({
  // ...
  clientVersion,
});
```

- Add CSP nonce support to RSC document rendering
([#&#8203;15320](https://redirect.github.com/remix-run/react-router/pull/15320))

- Add `nonce` options to `unstable_routeRSCServerRequest` and
`unstable_RSCStaticRouter`
- Forward the nonce to the HTML renderer and apply it to injected RSC
payload scripts and nonce-aware framework components

To adopt nonce-based CSP, update your `entry.ssr.tsx` (run `react-router
reveal entry.ssr` first in RSC Framework Mode) to generate a fresh nonce
for each request. Pass it to `routeRSCServerRequest`, spread the
`renderHTML` options into React's HTML renderer, pass `options.nonce` to
`RSCStaticRouter`, and use the same nonce in the
`Content-Security-Policy` response header:

  ```tsx
  const nonce = crypto.randomUUID();
  const response = await routeRSCServerRequest({
    request,
    serverResponse,
    createFromReadableStream,
    nonce,
    async renderHTML(getPayload, options) {
      const payload = getPayload();
      return renderHTMLToReadableStream(
<RSCStaticRouter getPayload={getPayload} nonce={options.nonce} />,
        {
          ...options,
          bootstrapScriptContent,
          formState: await payload.formState,
          signal: request.signal,
        },
      );
    },
  });
  response.headers.set(
    "Content-Security-Policy",
    `script-src 'self' 'nonce-${nonce}'`,
  );
  ```

</details>

<details>
<summary>typescript-eslint/typescript-eslint
(typescript-eslint)</summary>

###
[`v8.65.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8650-2026-07-20)

[Compare
Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.64.0...v8.65.0)

##### 🚀 Features

- add warning when TS 7 is detected
([#&#8203;12529](https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529))

##### ❤️ Thank You

- Josh Goldberg ✨
- Kirk Waiblinger
[@&#8203;kirkwaiblinger](https://redirect.github.com/kirkwaiblinger)

See [GitHub
Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0)
for more information.

You can read about our [versioning
strategy](https://typescript-eslint.io/users/versioning) and
[releases](https://typescript-eslint.io/users/releases) on our website.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/UI5/webcomponents-react).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

examples/react-router-ts/package-lock.json

@@ -11,8 +11,8 @@
     "typecheck": "react-router typegen && tsc"
   },
   "dependencies": {
-    "@react-router/node": "8.2.0",
-    "@react-router/serve": "8.2.0",
+    "@react-router/node": "8.3.0",
+    "@react-router/serve": "8.3.0",
     "@ui5/webcomponents": "2.24.0",
     "@ui5/webcomponents-base": "2.24.0",
     "@ui5/webcomponents-fiori": "2.24.0",
@@ -21,10 +21,10 @@
     "isbot": "5.2.1",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "react-router": "8.2.0"
+    "react-router": "8.3.0"
   },
   "devDependencies": {
-    "@react-router/dev": "8.2.0",
+    "@react-router/dev": "8.3.0",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "eslint": "9.39.5",
@@ -35,7 +35,7 @@
     "eslint-plugin-react-hooks": "7.1.1",
     "globals": "17.7.0",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.64.0",
+    "typescript-eslint": "8.65.0",
     "vite": "8.1.5",
     "vite-tsconfig-paths": "6.1.1"
   },

examples/react-router-ts/package.json

@@ -22,19 +22,19 @@
     "@ui5/webcomponents-react": "2.24.1",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "react-router": "8.2.0"
+    "react-router": "8.3.0"
   },
   "devDependencies": {
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "@ui5/webcomponents-cypress-commands": "2.24.1",
     "@vitejs/plugin-react": "6.0.3",
-    "cypress": "15.18.1",
+    "cypress": "15.19.0",
     "eslint": "9.39.5",
     "eslint-plugin-react-hooks": "7.1.1",
     "eslint-plugin-react-refresh": "0.5.3",
     "globals": "17.7.0",
-    "typescript-eslint": "8.64.0",
+    "typescript-eslint": "8.65.0",
     "vite": "8.1.5"
   }
 }