chore: Bump the web group across 1 directory with 2 updates

[dependabot]

Bumps the web group with 2 updates in the /web directory: @tanstack/react-router and @tanstack/router-plugin.

Updates @tanstack/react-router from 1.170.32 to 1.170.33

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.33

Patch Changes

• #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

• #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

  When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

• #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

• #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

• #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

• #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

  • @​tanstack/router-core@​1.171.28
  • @​tanstack/history@​1.162.2

Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.33

Patch Changes

• #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

• #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

  When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

• #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

• #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

• #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

• #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

  • @​tanstack/router-core@​1.171.28
  • @​tanstack/history@​1.162.2

Commits

• a58e01c ci: Version Packages (#8182)
• 08eff50 fix(router-core): fix dangling references in published declarations (#8207)
• cf166d1 fix(react-router): avoid rewriting unchanged head assets (#8257)
• 07b3bc9 test(react-router): cover pending and not-found context (#8243)
• 2f20c00 fix(router-core): skip lifecycle callbacks below fallback boundaries (#8165)
• 0497cae perf(router): use URL.canParse for absolute URL checks (#8251)
• 28a5e45 fix(router): handle unknown error boundary values (#8209)
• f0b5eda fix(router-core): retain not-found boundary during navigation (#8161)
• 0caf6b9 fix: preserve shouldThrow in route-scoped hooks (#8169)
• See full diff in compare view

Updates @tanstack/router-plugin from 1.168.35 to 1.168.36

Release notes

Sourced from @​tanstack/router-plugin's releases.

@​tanstack/router-plugin@​1.168.36

Patch Changes

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, 0caf6b9, ee28348, cf166d1, c18e690]:
  • @​tanstack/router-core@​1.171.28
  • @​tanstack/react-router@​1.170.33
  • @​tanstack/router-generator@​1.167.34

Changelog

Sourced from @​tanstack/router-plugin's changelog.

1.168.36

Patch Changes

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, 0caf6b9, ee28348, cf166d1, c18e690]:
  • @​tanstack/router-core@​1.171.28
  • @​tanstack/react-router@​1.170.33
  • @​tanstack/router-generator@​1.167.34

Commits

• a58e01c ci: Version Packages (#8182)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
climb-trainer	Error		Sep 10, 2026 2:10pm UTC

[kilianmc]

Superseded by #153, which lands the same two packages plus the error-boundary fix this bump requires.

Three things this PR could not know:

1. 1.170.33 retypes a boundary's error as unknown (TanStack #8209), which is why the web job here fails. chore(deps): supersede dependabot #144, pinning the router at the last version the mount survives #153 narrows it properly — the router also preserves falsy throws, so null, 0 and plain objects reach the boundary and the old code crashed on them.
2. Latest stable is 1.170.35 / 1.168.37, and it is not takeable. From 1.170.34 (TanStack #8308) the router treats any href with a scheme as an external link and drops its onClick. createRemoteHistory sets createHref to an absolute standalone URL by construction (issue PR #5 decision: memory-history <Link> hrefs resolve against the shell's origin #16), so the federated mount would leave kilianmc.com on every left-click. remote.guard.test.tsx catches it.
3. Both packages are therefore pinned exactly in chore(deps): supersede dependabot #144, pinning the router at the last version the mount survives #153, since ^1.170.33 permits the version that breaks the mount.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml