chore(webui): upgrade React to v19 and React Router to v7/v8

[vinokurig]

Upgrade react-router and react-router-dom from 6.30.4 to 7.18.1 to address CVE-2026-42342.

[netomi]

the project still uses v6.x of react/router and should thus not be affected by that CVE:

it is also not listed in the dependabot vulnerability tab

[netomi]

@gnugomez can you take a look here and assess whether the upgrade to the react/router 7+ is doable.

[gnugomez]

@netomi even if we where in the vulnerable version our app uses BrowserRouter so this would should not affect us https://github.com/gnugomez/openvsx/blob/f025e3d0259b4461e5b2ef64d2415c558f1e68fc/webui/src/default/default-app.tsx#L73-L75

This does not impact your React Router application if you are using Declarative Mode <BrowserRouter> or Data Mode (createBrowserRouter/<RouterProvider>).

Although it's valuable to keep react-router up to date, but since we're taking the time to do so, why not it's latest major? right now the latest version is v8.1.0

https://reactrouter.com/7.18.1/upgrading/v6
https://reactrouter.com/upgrading/v7

[vinokurig]

@gnugomez

Although it's valuable to keep react-router up to date, but since we're taking the time to do so, why not it's latest major? right now the latest version is v8.1.0

done, updated to the latest version

[netomi]

we cant update to v8 as the minimum required react version is stated as:

react@19.2.7+/react-dom@19.2.7+

while we are at 18.3.1 still.

[vinokurig]

right, reverted to the latest v7 version

[gnugomez]

yeah that's right... for updating to v7 I need to check but I believe we need to update some imports

[netomi]

it would make sense though to start updating to a more recent react version, active support for react 18 stopped a long time ago: https://endoflife.date/react

they still provide security updates though.

[netomi]

sorry if you misunderstood my comment. I was not asking you to upgrade to react 19 which we cant do just like that.

That will have to be properly tested and planned, and after some more discussions we are probably not be doing that soon.

[vinokurig]

@netomi Sorry, I am a little bit confused, would it be ok if I just update react-router to v7?

[netomi]

I dont get it that we need to update react/router as our version is not affected by the referenced CVE.

Updating to v7 will require testing as there are breaking changes that affect us afaict from the release notes

[vinokurig]

@netomi @gnugomez Since the project is not affected by the CVE, I would like to close the pull request, do you have any objections?

[netomi]

fine by me, we are working on a redesign of the app and that would be a good place to also update the router to v7