[renovate] Update dependency react-router-dom to v6.30.5 [SECURITY] by renovate[bot] · Pull Request #740 · SonarSource/echoes-react

renovate · 2026-07-23T20:35:51Z

This PR contains the following updates:

Package	Change	Age	Confidence
react-router-dom (source)	`^6.0.0` → `^6.30.5`
react-router-dom (source)	`6.30.4` → `6.30.5`

React Router: Open redirect leading to XSS

CVE-2026-53668 / GHSA-jjmj-jmhj-qwj2

More information

Details

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

remix-run/react-router (react-router-dom)

What's Changed

Throw an error if an action/loader function returns undefined as revalidations need to know whether the loader has previously been executed. undefined also causes issues during SSR stringification for hydration. You should always ensure your loader/action returns a value, and you may return null if you don't wish to return anything. (#9511)
Properly handle redirects to external domains (#9590, #9654)
Preserve the HTTP method on 307/308 redirects (#9597)
Support basename in static data routers (#9591)
Enhanced ErrorResponse bodies to contain more descriptive text in internal 403/404/405 scenarios
Fix issues with encoded characters in NavLink and descendant <Routes> (#9589, #9647)
Properly serialize/deserialize ErrorResponse instances when using built-in hydration (#9593)
Support basename in static data routers (#9591)
Updated dependencies:
- @remix-run/router@1.0.4
- react-router@6.4.4

Full Changelog: https://github.com/remix-run/react-router/compare/react-router-dom@6.4.3...react-router-dom@6.4.4

`v6.4.3`

Compare Source

`v6.4.2`

Compare Source

`v6.4.1`

Compare Source

`v6.4.0`

Compare Source

`v6.3.0`

Compare Source

`v6.2.2`

Compare Source

`v6.2.1`

Compare Source

`v6.2.0`

Compare Source

`v6.1.1`

Compare Source

`v6.1.0`

Compare Source

`v6.0.2`

Compare Source

✨ Features

Added the reloadDocument prop to <Link>. This allows <Link> to function like a normal anchor tag by reloading the document after navigation while maintaining the relative to resolution.

🗒️ Docs

Fixed several issues in docblocks and the docs themselves. See the full changelog for the deets!

🤝 New Contributors

@rwieruch made their first contribution in #8244
@ProProgrammer2504 made their first contribution in #8247
@Sannnao made their first contribution in #8263
@mattmazzola made their first contribution in #8255
@ngokevin made their first contribution in #8267
@TimisRobert made their first contribution in #8269
@mikeldking made their first contribution in #8279
@fishmandev made their first contribution in #8289

Full Changelog

`v6.0.1`

Compare Source

🐛 Bug Fixes

Add a default <StaticRouter location> value (#8243)
Add invariant for using <Route> inside <Routes> to help people make the change (#8238)

Configuration

📅 Schedule: (in timezone CET)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

If the PR is green: it means that the dependencies have been update successfully; double check the changelog and merge! When merging don't forget to squash the commit and add prefix the commit message witht the JIRA tickets that has been automatically created.
If the PR is red: something went wrong; double check the changelog and then either:
- Fix the issues if the breaking changes are quick to fix or you have the time for it: make sure to add a new commit and not to modify the one from the Renovate
- If the required changes are too big: create a JIRA ticket and assign it to the FEE squad, finally update the rennovate.json file to ignore the dependency and document the reason why it has been ignored, the Renovate PR can be closed.

To know more about the whole process, check our WebApp dependencies management xtranet page.

netlify · 2026-07-23T20:35:58Z

❌ Deploy Preview for echoes-react failed. Why did it fail? →

Name	Link
🔨 Latest commit	`928f873`
🔍 Latest deploy log	https://app.netlify.com/projects/echoes-react/deploys/6a84b416679938000838a220

renovate · 2026-08-18T19:35:55Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

! Corepack is about to download https://repo.yarnpkg.com/4.17.0/packages/yarnpkg-cli/bin/yarn.js

renovate Bot added renovate-dependencies renovate-vulnerability-alert labels Jul 23, 2026

renovate Bot requested a review from jeremy-davis-sonarsource July 23, 2026 20:35

renovate Bot force-pushed the renovate/npm-react-router-dom-vulnerability branch 2 times, most recently from b7133c4 to f1af55a Compare July 30, 2026 19:48

renovate Bot force-pushed the renovate/npm-react-router-dom-vulnerability branch from f1af55a to 9b68672 Compare August 12, 2026 02:48

renovate Bot changed the title ~~[renovate] Update dependency react-router-dom to v7 [SECURITY]~~ [renovate] Update dependency react-router-dom to v7 [SECURITY] - autoclosed Aug 12, 2026

renovate Bot closed this Aug 12, 2026

renovate Bot deleted the renovate/npm-react-router-dom-vulnerability branch August 12, 2026 20:56

renovate Bot changed the title ~~[renovate] Update dependency react-router-dom to v7 [SECURITY] - autoclosed~~ [renovate] Update dependency react-router-dom to v7 [SECURITY] Aug 13, 2026

renovate Bot reopened this Aug 13, 2026

renovate Bot force-pushed the renovate/npm-react-router-dom-vulnerability branch from 9b68672 to b855024 Compare August 13, 2026 05:53

[renovate] Update dependency react-router-dom to v6.30.5 [SECURITY]

928f873

renovate Bot force-pushed the renovate/npm-react-router-dom-vulnerability branch from b855024 to 928f873 Compare August 18, 2026 19:35

renovate Bot changed the title ~~[renovate] Update dependency react-router-dom to v7 [SECURITY]~~ [renovate] Update dependency react-router-dom to v6.30.5 [SECURITY] Aug 18, 2026

Navigation Menu

Uh oh!

[renovate] Update dependency react-router-dom to v6.30.5 [SECURITY] - #740

[renovate] Update dependency react-router-dom to v6.30.5 [SECURITY]#740
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-react-router-dom-vulnerability

renovate Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

React Router: Open redirect leading to XSS

Details

Severity

References

Release Notes

v6.4.4: v6.4.4

What's Changed

✨ Features

🗒️ Docs

🤝 New Contributors

Full Changelog

🐛 Bug Fixes

Configuration

Uh oh!

netlify Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for echoes-react failed. Why did it fail? →

Uh oh!

renovate Bot commented Aug 18, 2026

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 23, 2026 •

edited

Loading

`v6.4.4`: v6.4.4

netlify Bot commented Jul 23, 2026 •

edited

Loading