chore(deps-dev): Bump the react-router group across 1 directory with 3 updates

[dependabot]

Bumps the react-router group with 3 updates in the / directory: @react-router/dev, @react-router/node and react-router.

Updates @react-router/dev from 7.17.0 to 8.3.0

Release notes

Sourced from @​react-router/dev's releases.

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

Changelog

Sourced from @​react-router/dev's changelog.

v8.3.0

Minor Changes

• Restart react-router dev with --conditions=development when not already configured (#15291)

Patch Changes

• Allow typescript@7 to be used (#15317)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Add unstable_rsc/client-version client build version virtual module (#15318)

• Support the subResourceIntegrity config option in RSC Framework Mode (#15321)

  Migration guide

  No changes are required when using the default RSC SSR entry. If you maintain a custom app/entry.ssr.tsx, import the new virtual module and pass its hashes to React's importMap render option:

  +import subResourceIntegrity from "virtual:react-router/unstable_rsc/subresource-integrity";
  return renderToReadableStream(<RSCStaticRouter getPayload={getPayload} />, {
  ...options,
  bootstrapScriptContent,
  formState,
  
  importMap: subResourceIntegrity
  ? { integrity: subResourceIntegrity }
  : undefined,
  signal: request.signal,
  });

Updated dependencies:

• react-router@8.3.0
• @react-router/node@8.3.0
• @react-router/serve@8.3.0

v8.2.0

Minor Changes

• Add a Web Streams default server entry for non-Node Framework mode apps (#15290)
  • Apps using @react-router/node, @react-router/express, or @react-router/serve continue to use the renderToPipeableStream default server entry
  • Apps without those Node server adapter dependencies use a renderToReadableStream default server entry
  • Non-Node apps with their own entry.server.tsx may be able to remove it in favor of the default if it is not doing anything custom
• Detect nub as a supported package manager when installing framework dependencies (#15276)

... (truncated)

Commits

• 2edaca7 Release v8.3.0 (#15294)
• 687ab72 Prep release notes
• 4680094 feat: allow typescript@7 to be used with react-router (#15317)
• d2f1f1b update changes files to use h4 instead of h3 (#15334)
• ce44989 feat(rsc): support subResourceIntegrity (#15321)
• 6286f90 feat(rsc): reload stale clients after new deployments (#15318)
• 88ded38 Fix change file
• f1d0a41 chore: format
• 497a957 feat: restart with development condition (#15291)
• ac5d9d5 chore: format
• Additional commits viewable in compare view

Updates @react-router/node from 7.18.1 to 8.3.0

Release notes

Sourced from @​react-router/node's releases.

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

Changelog

Sourced from @​react-router/node's changelog.

v8.3.0

Patch Changes

• Allow typescript@7 to be used (#15317)
• Updated dependencies:
  • react-router@8.3.0

v8.2.0

Patch Changes

• Updated dependencies:
  • react-router@8.2.0

v8.1.0

Patch Changes

• Updated dependencies:
  • react-router@8.1.0

v8.0.1

Patch Changes

• Updated dependencies:
  • react-router@8.0.1

v8.0.0

Major Changes

• Switch from @mjackson/node-fetch-server to @remix-run/node-fetch-server now that we can directly use ESM-only packages (#14930)
• Update minimum Node version to 22.22.0 (#14928)

Patch Changes

• Bump dependencies (#15106)
  • Bumped @remix-run/node-fetch-server from ^0.13.0 to ^0.13.3
• Updated dependencies:
  • react-router@8.0.0

v7.18.0

Patch Changes

• Updated dependencies:
  • react-router@7.18.0

... (truncated)

Commits

• 2edaca7 Release v8.3.0 (#15294)
• 687ab72 Prep release notes
• 4680094 feat: allow typescript@7 to be used with react-router (#15317)
• 0518044 Release v8.2.0 (#15264)
• fdd896a Add tsconfigs for test files (#15279)
• 3287614 Release v8.1.0 (#15227)
• d10df2d Release v8.0.1 (#15210)
• 36122b3 Release v8.0.0 (#15198)
• 8fc707d chore: format
• 7e9be69 Version 8.0.0-pre.1
• Additional commits viewable in compare view

Updates react-router from 7.18.0 to 8.3.0

Release notes

Sourced from react-router's releases.

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

Changelog

Sourced from react-router's changelog.

v8.3.0

Patch Changes

• Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#15310)
  • Characters that are valid literally in a path segment ($ & + , ; = : @ — RFC 3986 pchar) are no longer percent-encoded, so values like a semver build 1.0.0+1 interpolate unchanged instead of becoming 1.0.0%2B1
  • Structural/unsafe characters (/ ? # %, whitespace, non-ASCII) are still escaped exactly as before
• Use crypto.randomUUID() for createMemorySessionStorage session ids (#15302)
  • createMemorySessionStorage is only intended for local development and testing - sessions are lost when the server restarts
• Fix NavLink not applying its pending state when to has a trailing slash (#15300)
• Preserve RSC route component metadata so routes with a clientLoader can skip unnecessary server requests once their components have rendered while still fetching missing server-rendered elements (#15323)
• Harden RSC CSRF code paths (#15311)
• Fix server crash (TypeError: Invalid state: Unable to enqueue) when a request is aborted while the RSC HTML stream has a pending flush (#15286)
  • Handle cancellation of the injectRSCPayload readable side, clear the pending flush, and cancel the underlying RSC payload stream

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Detect stale RSC clients during lazy route discovery and reload the destination document (#15318)

  Migration

  Apps using the default RSC Framework entry do not need to make any changes. Apps with a custom entry.rsc.tsx should import the generated client version and pass it to unstable_matchRSCServerRequest:

  import clientVersion from "virtual:react-router/unstable_rsc/client-version";
  return unstable_matchRSCServerRequest({
  // ...
  clientVersion,
  });

• Add CSP nonce support to RSC document rendering (#15320)

  • Add nonce options to unstable_routeRSCServerRequest and unstable_RSCStaticRouter
  • Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components

  To adopt nonce-based CSP, update your entry.ssr.tsx (run react-router reveal entry.ssr first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to routeRSCServerRequest, spread the renderHTML options into React's HTML renderer, pass options.nonce to RSCStaticRouter, and use the same nonce in the Content-Security-Policy response header:

  const nonce = crypto.randomUUID();
  const response = await routeRSCServerRequest({
    request,
    serverResponse,
    createFromReadableStream,
    nonce,
    async renderHTML(getPayload, options) {
      const payload = getPayload();
      return renderHTMLToReadableStream(

... (truncated)

Commits

• 2edaca7 Release v8.3.0 (#15294)
• 687ab72 Prep release notes
• d2f1f1b update changes files to use h4 instead of h3 (#15334)
• 8186207 fix(rsc): preserve component metadata for client loader revalidation (#15323)
• c26e431 feat(rsc): support CSP nonces in document rendering (#15320)
• 6286f90 feat(rsc): reload stale clients after new deployments (#15318)
• 3d83ad4 docs: fix useLinkClickHandler defaultShouldRevalidate default description (#1...
• f75c89f Update docs links to v8 API reference (#15316)
• baa9ba6 fix: encode path params per RFC 3986 path-segment rules in href/generatePath ...
• 69debd1 fix: apply NavLink pending state when the to prop has a trailing slash (#15300)
• Additional commits viewable in compare view

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6373e65. Configure here.}

[cursor]

Unmet React Router v8 requirements

Medium Severity

The React Router v8 bump leaves react at ^18.3.1 and vite at ^6.4.3, while v8 requires React >=19.2.7, Node >=22.22.0 for @react-router/node, and Vite 7+ for framework mode. That mismatches the package engines and Volta Node 20 pin.

 

^{Reviewed by Cursor Bugbot for commit 6373e65. Configure here.}

[andreiborza]

#23642 (comment)

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml