chore(deps): bump react-router from 7.18.0 to 8.3.0

[dependabot]

Bumps react-router from 7.18.0 to 8.3.0.

Release notes

Sourced from react-router's releases.

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

Changelog

Sourced from react-router's changelog.

v8.3.0

Patch Changes

• Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#15310)
  • Characters that are valid literally in a path segment ($ & + , ; = : @ — RFC 3986 pchar) are no longer percent-encoded, so values like a semver build 1.0.0+1 interpolate unchanged instead of becoming 1.0.0%2B1
  • Structural/unsafe characters (/ ? # %, whitespace, non-ASCII) are still escaped exactly as before
• Use crypto.randomUUID() for createMemorySessionStorage session ids (#15302)
  • createMemorySessionStorage is only intended for local development and testing - sessions are lost when the server restarts
• Fix NavLink not applying its pending state when to has a trailing slash (#15300)
• Preserve RSC route component metadata so routes with a clientLoader can skip unnecessary server requests once their components have rendered while still fetching missing server-rendered elements (#15323)
• Harden RSC CSRF code paths (#15311)
• Fix server crash (TypeError: Invalid state: Unable to enqueue) when a request is aborted while the RSC HTML stream has a pending flush (#15286)
  • Handle cancellation of the injectRSCPayload readable side, clear the pending flush, and cancel the underlying RSC payload stream

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Detect stale RSC clients during lazy route discovery and reload the destination document (#15318)

  Migration

  Apps using the default RSC Framework entry do not need to make any changes. Apps with a custom entry.rsc.tsx should import the generated client version and pass it to unstable_matchRSCServerRequest:

  import clientVersion from "virtual:react-router/unstable_rsc/client-version";
  return unstable_matchRSCServerRequest({
  // ...
  clientVersion,
  });

• Add CSP nonce support to RSC document rendering (#15320)

  • Add nonce options to unstable_routeRSCServerRequest and unstable_RSCStaticRouter
  • Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components

  To adopt nonce-based CSP, update your entry.ssr.tsx (run react-router reveal entry.ssr first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to routeRSCServerRequest, spread the renderHTML options into React's HTML renderer, pass options.nonce to RSCStaticRouter, and use the same nonce in the Content-Security-Policy response header:

  const nonce = crypto.randomUUID();
  const response = await routeRSCServerRequest({
    request,
    serverResponse,
    createFromReadableStream,
    nonce,
    async renderHTML(getPayload, options) {
      const payload = getPayload();
      return renderHTMLToReadableStream(

... (truncated)

Commits

• 2edaca7 Release v8.3.0 (#15294)
• 687ab72 Prep release notes
• d2f1f1b update changes files to use h4 instead of h3 (#15334)
• 8186207 fix(rsc): preserve component metadata for client loader revalidation (#15323)
• c26e431 feat(rsc): support CSP nonces in document rendering (#15320)
• 6286f90 feat(rsc): reload stale clients after new deployments (#15318)
• 3d83ad4 docs: fix useLinkClickHandler defaultShouldRevalidate default description (#1...
• f75c89f Update docs links to v8 API reference (#15316)
• baa9ba6 fix: encode path params per RFC 3986 path-segment rules in href/generatePath ...
• 69debd1 fix: apply NavLink pending state when the to prop has a trailing slash (#15300)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mozilla-blender]

Reviewing this major version bump. Workflow run

[mozilla-blender]

Note: This PR has failing CircleCI checks.
BLEnder cannot access CircleCI log output, so it
may not be able to diagnose or fix the failure.
Consider migrating CI to GitHub Actions so BLEnder
can read failure logs directly.

[mozilla-blender]

BLEnder picked up this PR. Workflow run

[mozilla-blender]

NO_VERDICT: could not evaluate this major version bump — manual review needed.

[mozilla-blender]

Reviewing this major version bump. Workflow run

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

react-router 7.18.0 is installed (within the vulnerable range >=7.12.0 <8.3.0), but the advisory explicitly affects only applications using the unstable RSC (React Server Components) APIs. FXA uses react-router purely as a client-side SPA router (BrowserRouter, Routes, Route, useLocation, useNavigate in fxa-settings/fxa-admin-panel/fxa-react) built with classic webpack/CRA. None of the @react-router/* framework packages required for RSC mode are present in any package.json or in yarn.lock, and there are no references to unstable_/rsc/createFromReadableStream/matchRSCServerRequest. The CSRF-in-RSC code path is therefore never exercised, so the repo is not exposed. Bumping to 8.3.0 is still recommended as hygiene to clear the alert.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

react-router@7.18.0 is installed (within the vulnerable >=7.12.0,<8.3.0 range) and used by fxa-settings, fxa-admin-panel, and fxa-react, but exclusively as a client-side SPA router in webpack/CRA browser apps. The CVE is scoped strictly to react-router's unstable RSC (React Server Components) APIs, which the advisory itself notes only affect apps using the unstable RSC APIs. No source imports react-router/rsc, @react-router/dev, matchRSCServerRequest/routeRSCServerRequest, unstable_ RSC APIs, or react-router-serve; imports are limited to BrowserRouter/Routes/Route/useNavigate/useLocation/Navigate. React is pinned to 18.3.1 with no RSC/framework mode. The vulnerable CSRF-in-RSC code path is never exercised.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

react-router@7.18.0 is installed (within the vulnerable range >=7.12.0,<8.3.0) and used by fxa-settings, fxa-admin-panel, and fxa-react. However, the CSRF-in-RSC-mode advisory explicitly only affects applications using the unstable React Server Components (RSC) APIs. These FXA packages are client-side SPAs on React 18.3.1 using only the declarative Router API (BrowserRouter, Routes, Route, Navigate, useNavigate). There are no @react-router/* framework/server packages, no react-router/rsc subpath imports, no unstable_ RSC exports, and no server-side RSC handlers anywhere. The vulnerable code path is never exercised, so the repo is not affected at runtime.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

The repo installs react-router 7.18.0 (within the vulnerable >=7.12.0,<8.3.0 range) and uses it in the fxa-settings and fxa-admin-panel client-side React SPAs. However, this CVE-2026-22030 follow-up CSRF bypass only affects applications using React Router's unstable RSC (React Server Components) server-request code paths, as the advisory explicitly states. FXA uses only the classic client-side SPA router (BrowserRouter/Routes/Route/Navigate) built with CRA/rescripts+webpack; there are no imports of react-router/rsc, no unstable_ APIs, no matchRSCServerRequest, and no server-component runtime. The vulnerable code path is never exercised, so the repo is not affected at runtime. Bumping to 8.3.0 is still recommended as dependency hygiene since the installed version is in-range.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

react-router@7.18.0 is a direct dependency in fxa-settings, fxa-admin-panel, and fxa-react, which falls inside the vulnerable range (>=7.12.0, <8.3.0). However, the advisory is explicit that the CSRF bypass only affects applications using the unstable RSC (React Server Components) APIs. FxA uses only classic client-side routing (BrowserRouter, MemoryRouter, Routes/Route, Link, useNavigate, useLocation) across all 246 consuming files. A repo-wide search for every RSC-related identifier (matchRSCServerRequest, unstable_createCallServer, unstable_getRSCStream, RSCRouterContext, @react-router/rsc, etc.) returned zero matches, and no @react-router/rsc package is installed. The vulnerable code path is therefore never exercised, so the repo is not affected despite running an in-range version.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

The repo pins react-router@7.18.0, which is within the vulnerable range (>=7.12.0, <8.3.0), but the advisory only affects applications using the unstable RSC (React Server Components) APIs. The target uses react-router strictly as a client-side SPA routing library (BrowserRouter in fxa-settings, fxa-admin-panel, fxa-react), built with react-scripts/rescripts. None of the framework packages that expose the RSC/unstable code paths (@react-router/dev, @react-router/node, @react-router/serve) are declared in any package.json or present in yarn.lock, and there is no RSC config, server render entry, or unstable_/createStaticHandler usage. The vulnerable CSRF-in-RSC-mode code path is therefore never exercised. The alert is a version-range match on an unexercised feature (noise).

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

react-router 7.18.0 is present (within the vulnerable >=7.12.0,<8.3.0 range) in fxa-settings, fxa-admin-panel, and fxa-react. However, the advisory explicitly states the vulnerability only affects applications using the unstable RSC (React Server Components) APIs. This repo uses only the classic client-side declarative routing API (BrowserRouter, Routes, Route, Navigate) rendered via react-dom in webpack-built SPAs. It has no RSC/framework tooling (no @react-router/dev, no @react-router/serve/node, no Vite RSC plugin), so the vulnerable CSRF-bypass code path in RSC mode cannot be reached. The repo is not affected at runtime.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

react-router@7.18.0 is installed (within the vulnerable >=7.12.0,<8.3.0 range) in fxa-settings, fxa-admin-panel, and as a peer in fxa-react. However, the advisory explicitly states the CSRF bypass only affects applications using the unstable RSC (React Server Components) APIs. FxA uses react-router exclusively as a classic client-side SPA router (react-dom render + BrowserRouter in fxa-settings/src/index.tsx, CRA/webpack builds), with no @react-router/dev framework mode, no RSC imports, and no unstable_* RSC exports anywhere in the codebase. The vulnerable server-side action-execution code path is never exercised, so the repo is not affected at runtime.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

react-router 7.18.0 (in the vulnerable range >=7.12.0,<8.3.0) is installed and used only by packages/fxa-settings as a client-side SPA (BrowserRouter + react-dom client render at src/index.tsx:20,83). The advisory affects ONLY applications using the unstable RSC APIs, which require the @react-router/* framework/server packages. None of those packages (@react-router/server, createRequestListener, unstable RSC exports) exist in any package.json or the yarn.lock, and no RSC server runtime is present. The vulnerable RSC CSRF code path therefore cannot be reached, so the repo is not exploitable, though a version bump would clear the scanner flag.

This PR can be reviewed and merged as a normal dependency update.