chore(deps): supersede dependabot #144, pinning the router at the last version the mount survives

[kilianmc]

Supersedes #144. Same intent, different landing place, and one real bug fixed on the way.

#144 does not merge as proposed

It is a version update with no advisory — its release notes are bug fixes and type changes — and its web job fails. @tanstack/react-router 1.170.33 retypes a boundary's error as unknown (TanStack #8209) and RouteError declared it as Error, so the component is no longer assignable at two call sites (src/router.tsx, src/routes/__root.tsx).

The error component was lying about what it receives

The same upstream change preserves falsy throws, so 0, false, '', null and plain objects all reach the boundary. The old {error.message} crashed outright on null/undefined and rendered an empty line for the rest.

errorText() narrows for real — no cast, no any — and falls back to a readable sentence. Nine cases in web/src/ui/routeError.test.tsx drive the actual render rather than the helper: eight of the nine fail against the previous (error as Error).message, with TypeError: Cannot read properties of undefined (reading 'message') on the null cases.

The pin is not what Dependabot proposed

Latest stable is 1.170.35 / 1.168.37, verified against the registry — and it is not takeable. The pair cannot be split (router-plugin@1.168.37 peers ^1.170.34), and from 1.170.34 (TanStack #8308) the router classifies any href carrying a scheme as an external link and returns a bare <a> with no onClick.

createRemoteHistory sets createHref to an absolute climb.kilianmc.com URL by construction (issue #16, so cmd-click and copy-link reach the real app). So from 1.170.34 every ordinary left-click in the federated mount would leave kilianmc.com rather than navigate in place. remote.guard.test.tsx caught it — 1.170.33 green, 1.170.34 red — bisected against the registry.

package	before	after	latest available
@tanstack/react-router	^1.170.32	1.170.33	1.170.35
@tanstack/router-plugin	^1.168.35	1.168.36	1.168.37

Both are pinned exactly, because ^1.170.33 permits the version that breaks the mount — a caret plus that peer range lets a plain npm install float back to latest silently. The prohibition sits on the createHref assignment that causes it, the guard test points at that line, and the docstring's "left-clicks are unaffected" claim is now bounded by the version it stops being true at.

Not in this PR

Reworking issue #16's absolute-href mechanism is what would unblock 1.170.35. It needs a link component that renders an absolute href for modified clicks only, and it is its own decision.

npm run check:web green (1536 tests), npm run check:server green (1221 passed, 230 DB-backed skipped locally).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
climb-trainer	Ready	Preview	Sep 10, 2026 8:29pm UTC