fix(deps): update dependency react-router-dom to v7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
react-router-dom (source)	^6 → ^7.0.0
react-router-dom (source)	^6 → ^7.0.0

---

React Router: Open redirect leading to XSS

CVE-2026-53668 / GHSA-jjmj-jmhj-qwj2

More information

Details

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
• https://github.com/remix-run/react-router/pull/14718
• https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
• https://github.com/remix-run/react-router
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

remix-run/react-router (react-router-dom)

v7.0.0

Compare Source

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#​11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,

• Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#​11469)

• Remove single fetch future flag. (#​11522)

• Remove future.v7_startTransition flag (#​11696)

• Remove future.v7_normalizeFormMethod future flag (#​11697)

• Allow returning undefined from actions and loaders (#​11680)

• update minimum node version to 18 (#​11690)

• Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#​11726)

• Remove future.v7_throwAbortReason from internalized @remix-run/router package (#​11728)

• Add exports field to all packages (#​11675)

• node package no longer re-exports from react-router (#​11702)

• updates the minimum React version to 18 (#​11689)

• • Remove the future.v7_partialHydration flag (#​11725)
    • This also removes the <RouterProvider fallbackElement> prop
      • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
    • Also worth nothing there is a related breaking changer with this future flag:
      • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
      • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

• Remove future.v7_fetcherPersist flag (#​11731)

Minor Changes

• Add prefetching support to Link/NavLink when using Remix SSR (#​11402)
• Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#​11401)
• Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#​11396) (#​11400)

Patch Changes

• Memoize some RouterProvider internals to reduce uneccesary re-renders (#​11817)
• Updated dependencies:
  • react-router@7.0.0

---

Configuration

📅 Schedule: (in timezone US/Eastern)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: deployments/mit-ol/mfe_slot_config/frontend/xpro/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @openedx/frontend-app-instructor-dashboard@1.0.0
npm error Found: react-router-dom@7.18.1
npm error node_modules/react-router-dom
npm error   react-router-dom@"^7.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer react-router-dom@"^6" from @openedx/frontend-app-instructor-dashboard@1.0.0
npm error node_modules/@openedx/frontend-app-instructor-dashboard
npm error   @openedx/frontend-app-instructor-dashboard@"^1.0.0-alpha" from the root project
npm error
npm error Conflicting peer dependency: react-router-dom@6.30.4
npm error node_modules/react-router-dom
npm error   peer react-router-dom@"^6" from @openedx/frontend-app-instructor-dashboard@1.0.0
npm error   node_modules/@openedx/frontend-app-instructor-dashboard
npm error     @openedx/frontend-app-instructor-dashboard@"^1.0.0-alpha" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-24T07_08_09_572Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-24T07_08_09_572Z-debug-0.log

File name: deployments/mit-ol/mfe_slot_config/frontend/mitxonline/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @openedx/frontend-app-instructor-dashboard@1.1.0-alpha.2
npm error Found: react-router-dom@7.18.1
npm error node_modules/react-router-dom
npm error   react-router-dom@"^7.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer react-router-dom@"^6" from @openedx/frontend-app-instructor-dashboard@1.1.0-alpha.2
npm error node_modules/@openedx/frontend-app-instructor-dashboard
npm error   @openedx/frontend-app-instructor-dashboard@"^1.1.0-alpha" from the root project
npm error
npm error Conflicting peer dependency: react-router-dom@6.30.4
npm error node_modules/react-router-dom
npm error   peer react-router-dom@"^6" from @openedx/frontend-app-instructor-dashboard@1.1.0-alpha.2
npm error   node_modules/@openedx/frontend-app-instructor-dashboard
npm error     @openedx/frontend-app-instructor-dashboard@"^1.1.0-alpha" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-24T07_08_12_159Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-24T07_08_12_159Z-debug-0.log

File name: deployments/mit-ol/mfe_slot_config/frontend/mitx/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @openedx/frontend-app-instructor-dashboard@1.0.0
npm error Found: react-router-dom@7.18.1
npm error node_modules/react-router-dom
npm error   react-router-dom@"^7.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer react-router-dom@"^6" from @openedx/frontend-app-instructor-dashboard@1.0.0
npm error node_modules/@openedx/frontend-app-instructor-dashboard
npm error   @openedx/frontend-app-instructor-dashboard@"^1.0.0-alpha" from the root project
npm error
npm error Conflicting peer dependency: react-router-dom@6.30.4
npm error node_modules/react-router-dom
npm error   peer react-router-dom@"^6" from @openedx/frontend-app-instructor-dashboard@1.0.0
npm error   node_modules/@openedx/frontend-app-instructor-dashboard
npm error     @openedx/frontend-app-instructor-dashboard@"^1.0.0-alpha" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-24T07_08_14_617Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-24T07_08_14_617Z-debug-0.log