[renovate] Update dependency react-router-dom to v7 [SECURITY] by renovate[bot] · Pull Request #740 · SonarSource/echoes-react

renovate · 2026-07-23T20:35:51Z

This PR contains the following updates:

Package	Change	Age	Confidence
react-router-dom (source)	`^6.0.0` → `^7.0.0`
react-router-dom (source)	`6.30.4` → `7.0.0`

React Router: Open redirect leading to XSS

CVE-2026-53668 / GHSA-jjmj-jmhj-qwj2

More information

Details

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

remix-run/react-router (react-router-dom)

`v7.0.0`

Compare Source

Major Changes

Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)
- defer
- AbortedDeferredError
- type TypedDeferredData
- UNSAFE_DeferredData
- UNSAFE_DEFERRED_SYMBOL,
Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#11469)
Remove single fetch future flag. (#11522)
Remove future.v7_startTransition flag (#11696)
Remove future.v7_normalizeFormMethod future flag (#11697)
Allow returning undefined from actions and loaders (#11680)
update minimum node version to 18 (#11690)
Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#11726)
Remove future.v7_throwAbortReason from internalized @remix-run/router package (#11728)
Add exports field to all packages (#11675)
node package no longer re-exports from react-router (#11702)
updates the minimum React version to 18 (#11689)
- Remove the future.v7_partialHydration flag (#11725)
  - This also removes the <RouterProvider fallbackElement> prop
    - To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
  - Also worth nothing there is a related breaking changer with this future flag:
    - Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
    - With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load
Remove future.v7_fetcherPersist flag (#11731)

Minor Changes

Add prefetching support to Link/NavLink when using Remix SSR (#11402)
Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#11401)
Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#11396) (#11400)

Patch Changes

Memoize some RouterProvider internals to reduce uneccesary re-renders (#11817)
Updated dependencies:
- react-router@7.0.0

What's Changed

Throw an error if an action/loader function returns undefined as revalidations need to know whether the loader has previously been executed. undefined also causes issues during SSR stringification for hydration. You should always ensure your loader/action returns a value, and you may return null if you don't wish to return anything. (#9511)
Properly handle redirects to external domains (#9590, #9654)
Preserve the HTTP method on 307/308 redirects (#9597)
Support basename in static data routers (#9591)
Enhanced ErrorResponse bodies to contain more descriptive text in internal 403/404/405 scenarios
Fix issues with encoded characters in NavLink and descendant <Routes> (#9589, #9647)
Properly serialize/deserialize ErrorResponse instances when using built-in hydration (#9593)
Support basename in static data routers (#9591)
Updated dependencies:
- @remix-run/router@1.0.4
- react-router@6.4.4

Full Changelog: https://github.com/remix-run/react-router/compare/react-router-dom@6.4.3...react-router-dom@6.4.4

`v6.4.3`

Compare Source

`v6.4.2`

Compare Source

`v6.4.1`

Compare Source

`v6.4.0`

Compare Source

`v6.3.0`

Compare Source

`v6.2.2`

Compare Source

`v6.2.1`

Compare Source

`v6.2.0`

Compare Source

`v6.1.1`

Compare Source

`v6.1.0`

Compare Source

`v6.0.2`

Compare Source

✨ Features

Added the reloadDocument prop to <Link>. This allows <Link> to function like a normal anchor tag by reloading the document after navigation while maintaining the relative to resolution.

🗒️ Docs

Fixed several issues in docblocks and the docs themselves. See the full changelog for the deets!

🤝 New Contributors

@rwieruch made their first contribution in #8244
@ProProgrammer2504 made their first contribution in #8247
@Sannnao made their first contribution in #8263
@mattmazzola made their first contribution in #8255
@ngokevin made their first contribution in #8267
@TimisRobert made their first contribution in #8269
@mikeldking made their first contribution in #8279
@fishmandev made their first contribution in #8289

Full Changelog

`v6.0.1`

Compare Source

🐛 Bug Fixes

Add a default <StaticRouter location> value (#8243)
Add invariant for using <Route> inside <Routes> to help people make the change (#8238)

Configuration

📅 Schedule: (in timezone CET)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

If the PR is green: it means that the dependencies have been update successfully; double check the changelog and merge! When merging don't forget to squash the commit and add prefix the commit message witht the JIRA tickets that has been automatically created.
If the PR is red: something went wrong; double check the changelog and then either:
- Fix the issues if the breaking changes are quick to fix or you have the time for it: make sure to add a new commit and not to modify the one from the Renovate
- If the required changes are too big: create a JIRA ticket and assign it to the FEE squad, finally update the rennovate.json file to ignore the dependency and document the reason why it has been ignored, the Renovate PR can be closed.

To know more about the whole process, check our WebApp dependencies management xtranet page.

netlify · 2026-07-23T20:35:58Z

✅ Deploy Preview for echoes-react ready!

Name	Link
🔨 Latest commit	`b7133c4`
🔍 Latest deploy log	https://app.netlify.com/projects/echoes-react/deploys/6a6389d86d677a00094109bd
😎 Deploy Preview	https://deploy-preview-740--echoes-react.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

renovate Bot added renovate-dependencies renovate-vulnerability-alert labels Jul 23, 2026

renovate Bot requested a review from jeremy-davis-sonarsource July 23, 2026 20:35

[renovate] Update dependency react-router-dom to v7 [SECURITY]

b7133c4

renovate Bot force-pushed the renovate/npm-react-router-dom-vulnerability branch from 2ac7bec to b7133c4 Compare July 24, 2026 15:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[renovate] Update dependency react-router-dom to v7 [SECURITY]#740

[renovate] Update dependency react-router-dom to v7 [SECURITY]#740
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-react-router-dom-vulnerability

renovate Bot commented Jul 23, 2026

Uh oh!

netlify Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 23, 2026

React Router: Open redirect leading to XSS

Details

Severity

References

Release Notes

Major Changes

Minor Changes

Patch Changes

v6.4.4: v6.4.4

What's Changed

✨ Features

🗒️ Docs

🤝 New Contributors

Full Changelog

🐛 Bug Fixes

Configuration

Uh oh!

netlify Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for echoes-react ready!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v6.4.4`: v6.4.4

netlify Bot commented Jul 23, 2026 •

edited

Loading