Renovate: Update dependency react-router-dom to v7.18.1 #51

Open

renovate-bot wants to merge 1 commit from renovate/react-router-dom-7.x-lockfile into main

renovate-bot commented

2026-07-19 00:02:17 +00:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
react-router-dom (source)	dependencies	minor	`7.17.0` → `7.18.1`

Release Notes

remix-run/react-router (react-router-dom)

We made a bug fix in our underlying CSRF checks in this release that may be a "breaking bug fix" for some users deployed behind a reverse proxy. The CSRF check now checks directly against the host in the request url provided, instead of looking directly at HTTP headers which is an adapter concern. If your adapter is not setting the expected host in the request URL, you may need to add the new internal host to your allowedActionOrigins config. This is most likely to occur in @react-router/serve apps or @react-router/express apps without the trust proxy setting enabled. We recommend testing this against application mutation requests as part of your upgrade.

Minor Changes

@react-router/architect - Add a useRequestContextDomainName option to createRequestHandler to derive request URL hosts from the API Gateway request context (#15185)
- This flag will become the default behavior in v8, so it is recommended to adopt to prepare for and to v8 better align with your deployment architecture and rely less on manual header parsing in the adapter
- See the docs for more information

Patch Changes

react-router - Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true (#15173)
- Avoids false positive "SPA Mode" detection when serving prerendered paths
react-router - Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them (#15170)
react-router - Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)
react-router - Optimize route matching by extending precomputed route branches to include matchers (#15186)
react-router - Use the constructed request URL host instead of header checks when validating action request origins in the CSRF check (#15185)
react-router - Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)
react-router - Validate protocols in RSC render redirects (#15177)
react-router - Consolidate url normalization logic and better handle mixed slashes (#15176)
@react-router/dev - Pass Vite server.watch config to child compiler in development mode. (#15178)
@react-router/dev - Ignore external Vite server environments in Framework Mode build hooks (#14883)
- When future.v8_viteEnvironmentApi is enabled, React Router previously treated any non-client Vite environment as its own server build
- This caused issues with integrations like Nitro, where plugins can register additional environments
- Framework Mode build hooks now ignore external server environments and only process the app's own server build
@react-router/express - Adjust express adapter host computation (#15185)
- read port from x-forwarded-host based on trust proxy setting
- handle invalid hostname characters

Full Changelog: v7.17.0...v7.18.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [react-router-dom](https://github.com/remix-run/react-router) ([source](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom)) | dependencies | minor | [`7.17.0` → `7.18.1`](https://renovatebot.com/diffs/npm/react-router-dom/7.17.0/7.18.1) | --- ### Release Notes <details> <summary>remix-run/react-router (react-router-dom)</summary> ### [`v7.18.1`](https://github.com/remix-run/react-router/compare/react-router-dom@7.18.0...react-router-dom@7.18.1) [Compare Source](https://github.com/remix-run/react-router/compare/react-router-dom@7.18.0...react-router-dom@7.18.1) ### [`v7.18.0`](https://github.com/remix-run/react-router/blob/HEAD/CHANGELOG.md#v7180) [Compare Source](https://github.com/remix-run/react-router/compare/react-router-dom@7.17.0...react-router-dom@7.18.0) Date: 2026-06-16 ##### What's Changed ##### CSRF Check Logic Fix We made a bug fix in our underlying CSRF checks in this release that may be a "breaking bug fix" for some users deployed behind a reverse proxy. The CSRF check now checks directly against the `host` in the `request` url provided, instead of looking directly at HTTP headers which is an adapter concern. If your adapter is not setting the expected host in the request URL, you may need to add the new internal host to your `allowedActionOrigins` config. This is most likely to occur in `@react-router/serve` apps or `@react-router/express` apps without the `trust proxy` setting enabled. We recommend testing this against application mutation requests as part of your upgrade. ##### Minor Changes - `@react-router/architect` - Add a `useRequestContextDomainName` option to `createRequestHandler` to derive request URL hosts from the API Gateway request context ([#15185](https://github.com/remix-run/react-router/pull/15185)) - This flag will become the default behavior in v8, so it is recommended to adopt to prepare for and to v8 better align with your deployment architecture and rely less on manual header parsing in the adapter - See the [docs](https://reactrouter.com/api/other-api/adapter#react-routerarchitect) for more information ##### Patch Changes - `react-router` - Fix server handler prerender responses when using `ssr: false` and `future.v8_trailingSlashAwareDataRequests: true` ([#15173](https://github.com/remix-run/react-router/pull/15173)) - Avoids false positive "SPA Mode" detection when serving prerendered paths - `react-router` - Use the `ServerRouter` `nonce` for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them ([#15170](https://github.com/remix-run/react-router/pull/15170)) - `react-router` - Use `turbo-stream` to serialize and deserialize Framework Mode hydration errors ([#15175](https://github.com/remix-run/react-router/pull/15175)) - `react-router` - Optimize route matching by extending precomputed route branches to include matchers ([#15186](https://github.com/remix-run/react-router/pull/15186)) - `react-router` - Use the constructed `request` URL `host` instead of header checks when validating action request origins in the CSRF check ([#15185](https://github.com/remix-run/react-router/pull/15185)) - `react-router` - Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows ([#15175](https://github.com/remix-run/react-router/pull/15175)) - `react-router` - Validate protocols in RSC render redirects ([#15177](https://github.com/remix-run/react-router/pull/15177)) - `react-router` - Consolidate url normalization logic and better handle mixed slashes ([#15176](https://github.com/remix-run/react-router/pull/15176)) - `@react-router/dev` - Pass Vite `server.watch` config to child compiler in development mode. ([#15178](https://github.com/remix-run/react-router/pull/15178)) - `@react-router/dev` - Ignore external Vite server environments in Framework Mode build hooks ([#14883](https://github.com/remix-run/react-router/pull/14883)) - When `future.v8_viteEnvironmentApi` is enabled, React Router previously treated any non-client Vite environment as its own server build - This caused issues with integrations like Nitro, where plugins can register additional environments - Framework Mode build hooks now ignore external server environments and only process the app's own server build - `@react-router/express` - Adjust express adapter host computation ([#15185](https://github.com/remix-run/react-router/pull/15185)) - read port from `x-forwarded-host` based on `trust proxy` setting - handle invalid hostname characters **Full Changelog**: [`v7.17.0...v7.18.0`](https://github.com/remix-run/react-router/compare/react-router@7.17.0...react-router@7.18.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-19 00:02:18 +00:00