fix: update React Router to 7.18.2 - #10967
Merged
Merged
Conversation
jbg
marked this pull request as ready for review
August 5, 2026 17:35
jbg
enabled auto-merge
August 5, 2026 17:39
Abhijay007
approved these changes
Aug 5, 2026
lifeizhou-ap
added a commit
that referenced
this pull request
Aug 6, 2026
* main: (32 commits) fix: keep turn-context in place for OpenAI Responses-stack models so prompt caching works (#10993) fix(developer): byte-bound the shell truncation preview (#10992) fix(openrouter): stop silently ignoring thinking effort off (#10991) fix: dispatch edited queued messages (#10933) fix: contain recipe template paths (#10930) fix: make shell approval titles faithful (#10986) fix: block MCP app form submissions (#10985) fix: migrate desktop routing to React Router 8.3.0 (#10971) fix: sanitize Bedrock tool errors (#10934) fix implicit OAuth during model discovery (#10929) fix: update React Router to 7.18.2 (#10967) test: early-exit code-exec smoke tests once tool invocation is observed (#10954) fix: keep ACP session naming out of live conversations (#10963) Bind MCP apps to trusted ownership metadata (#10747) tests: add recursion_limit attribute to remaining ACP test files (#10559) Sanitize Unicode tags in MCP resources (#10746) fix(oauth): preserve RFC 9207 iss from MCP OAuth callback (#10678) feat(installer): detect Termux and select musl portable build (#10568) feat: add Celeris provider (#10714) fix: shell ACP providers on desktop (#10907) ...
lifeizhou-ap
added a commit
that referenced
this pull request
Aug 6, 2026
* main: (101 commits) fix: keep turn-context in place for OpenAI Responses-stack models so prompt caching works (#10993) fix(developer): byte-bound the shell truncation preview (#10992) fix(openrouter): stop silently ignoring thinking effort off (#10991) fix: dispatch edited queued messages (#10933) fix: contain recipe template paths (#10930) fix: make shell approval titles faithful (#10986) fix: block MCP app form submissions (#10985) fix: migrate desktop routing to React Router 8.3.0 (#10971) fix: sanitize Bedrock tool errors (#10934) fix implicit OAuth during model discovery (#10929) fix: update React Router to 7.18.2 (#10967) test: early-exit code-exec smoke tests once tool invocation is observed (#10954) fix: keep ACP session naming out of live conversations (#10963) Bind MCP apps to trusted ownership metadata (#10747) tests: add recursion_limit attribute to remaining ACP test files (#10559) Sanitize Unicode tags in MCP resources (#10746) fix(oauth): preserve RFC 9207 iss from MCP OAuth callback (#10678) feat(installer): detect Termux and select musl portable build (#10568) feat: add Celeris provider (#10714) fix: shell ACP providers on desktop (#10907) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
react-router-domfrom 7.13.1 to 7.18.2react-routerpackage also resolves to 7.18.2This remediates the five advisories from #10964 that have fixes within React Router 7.x. The remaining
GHSA-qwww-vcr4-c8h2advisory requires React Router 8.3.0 and is intentionally outside this narrow update.Why
Dependabot detected the transitive
react-routeradvisories but reported that it could not update the package from 7.13.1. Updating the directreact-router-domdependency unlocks the patched 7.x transitive version.Addresses #10964.
Verification
pnpm install --frozen-lockfile --lockfile-only --ignore-scriptspnpm --filter goose-app list react-router react-router-dom --depth 1pnpm run typecheckinui/desktopafter building@aaif/goose-sdk