chore(deps-dev): bump react-router from 6.30.2 to 7.18.2

[dependabot]

Bumps react-router from 6.30.2 to 7.18.2.

Changelog

Sourced from react-router's changelog.

v7.18.2

Patch Changes

• Harden RSC CSRF codepaths. (#15353)

v7.18.1

Patch Changes

• No changes

v7.18.0

Patch Changes

• Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)
• Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)
• Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)
• Precompute route branch matchers to avoid recompiling route path regexes during matching (#15186)
• Use the constructed request URL host when validating action request origins. (#15185)
• Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)
• Validate protocols in RSC render redirects (#15177)
• Consolidate url normalization logic and better handle mixed slashes (#15176)

v7.17.0

Minor Changes

• Ship a subset of the official documentation inside the react-router package (#15121)
  • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
  • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Minor Changes

• Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#15098)

Patch Changes

• Disable manifest path when lazy route dicovery is disabled (#15068)

• Fix browser URL creation to use the configured history window instead of the global window. (#15066)

  • Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.

• Fix useNavigation() return type to preserve discriminated union across navigation states (#15095)

• Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#15082)

... (truncated)

Commits

• 69a653e Release v7.18.2 (#15354)
• 8ebd5df Harden RSC CSRF codepaths (backport of #15311) (#15353)
• afdf85d Release v7.18.1 (#15253)
• 6fb1e79 Release v7.18.0 (#15187)
• 09e6020 Optimize route matching internals (#15186)
• 5b57f5f Request Host derivation + CSRF check simplifications (#15185)
• ce596e8 Validate RSC redirect protocols (#15177)
• 1cebd2a chore: format
• 9d22943 Use turbo stream for framework hydration errors (#15175)
• bf63729 Consolidate url normalization logic (#15176)
• Additional commits viewable in compare view

---

Note

Low Risk
Scope is limited to a devDependency and lockfile; runtime consumers of the UI kit are unchanged unless they independently adopt React Router 7 APIs.

Overview
Bumps the devDependency react-router from v6 (^6.22.3 / lock 6.30.2) to v7 (^7.18.2 / lock 7.18.2). There are no application or library source changes in this PR—only package.json and pnpm-lock.yaml.

The lockfile reflects React Router 7’s packaging: @remix-run/router is dropped as a separate dependency, and cookie / set-cookie-parser are pulled in. react-router now lists react-dom as a peer (optional in metadata) and requires Node ≥20. Unrelated transitive updates (e.g. some @codemirror/* resolutions) come along with the refreshed lockfile.

^{Reviewed by Cursor Bugbot for commit 06bc217. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cube-ui-kit	Ready	Preview	Aug 17, 2026 1:45pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 06bc217

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

📦 NPM canary release

Deployed canary version 0.0.0-canary-631769a.

[github-actions]

🏋️ Size limit report

Name	Size	Passed?
All	487.43 KB (0% 🟰)	Yes 🎉
Tree shaking (just a Button)	119.6 KB (0% 🟰)	Yes 🎉

Compared against main at 6e2bd43 — run 32035596811, 2026-08-17T13:31:41Z.

Click here if you want to find out what is changed in this build

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit a890039. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.