fix(deps): bump react-router to 7.18.1 (clears 4 of 6 alerts)

[Trifunovich]

Release notes

• Security: router updated to 7.18.1 — fixes a denial-of-service in route matching.
• Security: fixes an open redirect in in-app links and navigation.
• No user-visible behaviour or API changes.

---

Bumps react-router / react-router-dom 7.17.0 -> 7.18.1. Lockfile only — package.json already declares ^7.17.0, which permits 7.18.1.

Clears 4 of the 6 open alerts

GHSA	Sev	Fixed here
GHSA-chx6-hx7r-mcp5 — DoS via inefficient route matching	high	yes (7.18.0)
GHSA-337j-9hxr-rhxg — arbitrary constructor injection in deserializeErrors()	medium	yes (7.18.0)
GHSA-wrjc-x8rr-h8h6 — open redirect via backslash in <Link>/useNavigate	medium	yes (7.18.0)
GHSA-h8fp-f39c-q6mh — RSCErrorHandler missing protocol validation	medium	yes (7.18.0)
GHSA-qwww-vcr4-c8h2 — RSC mode CSRF bypass	high	no — needs 8.3.0
GHSA-r28c-9q8g-f849 — postcss path traversal	high	no — covered by #47

The remaining react-router high needs 8.3.0. That is not a version bump: react-router-dom has no 8.x (latest is 7.18.1), so v8 means rewriting every react-router-dom import to react-router. Tracked separately.

Both unfixed-here advisories are RSC-mode issues. This app is a client-side SPA (BrowserRouter, vite build, no SSR/RSC entry point), so neither is reachable in the current configuration.

Why Dependabot could not do this

Its security job targeted react-router, which is transitive here and pinned exactly by react-router-dom@7.17.0:

The latest possible version that can be installed is 7.17.0
because of the following conflicting dependencies

It runs with allowed-updates: direct and update-subdependencies: false, so it cannot lift a transitive package, and it will not re-propose the direct bump because PR #7 for exactly 7.18.1 was closed on 2026-07-03 (collateral of a main history rewrite, not a rejection).

Validation

Lockfile regenerated with a full install (not --package-lock-only) on node:24, preserving the libc metadata. Both CI consumers exercised in matching containers:

• node:24 (glibc, npm 11.16.0) — npm ci + npm test: 15 files, 101 tests pass
• node:20-alpine (musl, npm 10.8.2) — npm ci + npm run build: builds clean

Diff is 7 insertions / 7 deletions: version, resolved, integrity for both packages plus the internal pin.