fix(deps): update dependency react-router-dom to v7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
react-router-dom (source)	^6.30.3 → ^7.0.0

---

React Router: Open redirect leading to XSS

CVE-2026-53668 / GHSA-jjmj-jmhj-qwj2

More information

Details

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
• https://github.com/remix-run/react-router/pull/14718
• https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
• https://github.com/remix-run/react-router
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

remix-run/react-router (react-router-dom)

v7.0.0

Compare Source

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#​11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,

• Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#​11469)

• Remove single fetch future flag. (#​11522)

• Remove future.v7_startTransition flag (#​11696)

• Remove future.v7_normalizeFormMethod future flag (#​11697)

• Allow returning undefined from actions and loaders (#​11680)

• update minimum node version to 18 (#​11690)

• Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#​11726)

• Remove future.v7_throwAbortReason from internalized @remix-run/router package (#​11728)

• Add exports field to all packages (#​11675)

• node package no longer re-exports from react-router (#​11702)

• updates the minimum React version to 18 (#​11689)

• • Remove the future.v7_partialHydration flag (#​11725)
    • This also removes the <RouterProvider fallbackElement> prop
      • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
    • Also worth nothing there is a related breaking changer with this future flag:
      • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
      • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

• Remove future.v7_fetcherPersist flag (#​11731)

Minor Changes

• Add prefetching support to Link/NavLink when using Remix SSR (#​11402)
• Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#​11401)
• Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#​11396) (#​11400)

Patch Changes

• Memoize some RouterProvider internals to reduce uneccesary re-renders (#​11817)
• Updated dependencies:
  • react-router@7.0.0

---

Configuration

📅 Schedule: (in timezone US/Eastern)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.