Update dependency react-router to v8.3.0 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
react-router (source)	8.2.0 → 8.3.0

---

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

GHSA-qwww-vcr4-c8h2

More information

Details

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.

[!NOTE]
This only affects your application if you are using the unstable RSC APIs

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2
• https://github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830
• https://github.com/remix-run/react-router/releases/tag/react-router@8.3.0
• http://github.com/remix-run/react-router/pull/15311
• https://github.com/advisories/GHSA-qwww-vcr4-c8h2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

remix-run/react-router (react-router)

v8.3.0

Compare Source

Patch Changes

• Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#​15310)
  • Characters that are valid literally in a path segment ($ & + , ; = : @​ — RFC 3986 pchar) are no longer percent-encoded, so values like a semver build 1.0.0+1 interpolate unchanged instead of becoming 1.0.0%2B1
  • Structural/unsafe characters (/ ? # %, whitespace, non-ASCII) are still escaped exactly as before
• Use crypto.randomUUID() for createMemorySessionStorage session ids (#​15302)
  • createMemorySessionStorage is only intended for local development and testing - sessions are lost when the server restarts
• Fix NavLink not applying its pending state when to has a trailing slash (#​15300)
• Preserve RSC route component metadata so routes with a clientLoader can skip unnecessary server requests once their components have rendered while still fetching missing server-rendered elements (#​15323)
• Harden RSC CSRF code paths (#​15311)
• Fix server crash (TypeError: Invalid state: Unable to enqueue) when a request is aborted while the RSC HTML stream has a pending flush (#​15286)
  • Handle cancellation of the injectRSCPayload readable side, clear the pending flush, and cancel the underlying RSC payload stream

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Detect stale RSC clients during lazy route discovery and reload the destination document (#​15318)

Migration

Apps using the default RSC Framework entry do not need to make any changes. Apps with a custom entry.rsc.tsx should import the generated client version and pass it to unstable_matchRSCServerRequest:

import clientVersion from "virtual:react-router/unstable_rsc/client-version";

return unstable_matchRSCServerRequest({
  // ...
  clientVersion,
});

• Add CSP nonce support to RSC document rendering (#​15320)

  • Add nonce options to unstable_routeRSCServerRequest and unstable_RSCStaticRouter
  • Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components

  To adopt nonce-based CSP, update your entry.ssr.tsx (run react-router reveal entry.ssr first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to routeRSCServerRequest, spread the renderHTML options into React's HTML renderer, pass options.nonce to RSCStaticRouter, and use the same nonce in the Content-Security-Policy response header:

  const nonce = crypto.randomUUID();
  const response = await routeRSCServerRequest({
    request,
    serverResponse,
    createFromReadableStream,
    nonce,
    async renderHTML(getPayload, options) {
      const payload = getPayload();
      return renderHTMLToReadableStream(
        <RSCStaticRouter getPayload={getPayload} nonce={options.nonce} />,
        {
          ...options,
          bootstrapScriptContent,
          formState: await payload.formState,
          signal: request.signal,
        },
      );
    },
  });
  response.headers.set(
    "Content-Security-Policy",
    `script-src 'self' 'nonce-${nonce}'`,
  );

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: src/MPlusKeybot.Web/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @react-router/express@8.2.0
npm warn Found: react-router@8.3.0
npm warn node_modules/react-router
npm warn   react-router@"8.3.0" from the root project
npm warn   1 more (@react-router/dev)
npm warn
npm warn Could not resolve dependency:
npm warn peer react-router@"8.2.0" from @react-router/express@8.2.0
npm warn node_modules/@react-router/express
npm warn   @react-router/express@"8.2.0" from @react-router/serve@8.2.0
npm warn   node_modules/@react-router/serve
npm warn
npm warn Conflicting peer dependency: react-router@8.2.0
npm warn node_modules/react-router
npm warn   peer react-router@"8.2.0" from @react-router/express@8.2.0
npm warn   node_modules/@react-router/express
npm warn     @react-router/express@"8.2.0" from @react-router/serve@8.2.0
npm warn     node_modules/@react-router/serve
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @react-router/node@8.2.0
npm error Found: react-router@8.3.0
npm error node_modules/react-router
npm error   react-router@"8.3.0" from the root project
npm error   peer react-router@"^8.2.0" from @react-router/dev@8.2.0
npm error   node_modules/@react-router/dev
npm error     dev @react-router/dev@"8.2.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer react-router@"8.2.0" from @react-router/node@8.2.0
npm error node_modules/@react-router/node
npm error   @react-router/node@"8.2.0" from the root project
npm error   @react-router/node@"8.2.0" from @react-router/dev@8.2.0
npm error   node_modules/@react-router/dev
npm error     dev @react-router/dev@"8.2.0" from the root project
npm error   2 more (@react-router/express, @react-router/serve)
npm error
npm error Conflicting peer dependency: react-router@8.2.0
npm error node_modules/react-router
npm error   peer react-router@"8.2.0" from @react-router/node@8.2.0
npm error   node_modules/@react-router/node
npm error     @react-router/node@"8.2.0" from the root project
npm error     @react-router/node@"8.2.0" from @react-router/dev@8.2.0
npm error     node_modules/@react-router/dev
npm error       dev @react-router/dev@"8.2.0" from the root project
npm error     2 more (@react-router/express, @react-router/serve)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-30T16_10_45_523Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-30T16_10_45_523Z-debug-0.log

[not-adam]

Mira PR Walkthrough

Bumps react-router from 8.2.0 to 8.3.0 to patch a CSRF bypass vulnerability (GHSA-qwww-vcr4-c8h2) affecting unstable RSC code paths. The change is a single-line version bump in package.json.

Confidence: 4/5   ◉◉◉◉○   Safe with minor fixes

• The security fix is low-risk (only affects unstable RSC APIs), but the other @react-router/* packages remain at 8.2.0, creating a version mismatch that should be verified.

1 file reviewed

---

Comment @not-adam help to get the list of available commands and usage tips.