Repository navigation
chore(deps): bump react-router from 7.12.0 to 8.0.1 in /internal/dev_server/ui - #729
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) from 7.12.0 to 8.0.1. - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@8.0.1/packages/react-router) --- updated-dependencies: - dependency-name: react-router dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4a64919. Configure here.
| "react": "18.3.1", | ||
| "react-dom": "18.3.1", | ||
| "react-router": "7.12.0", | ||
| "react-router": "8.0.1", |
There was a problem hiding this comment.
Router eight with React eighteen
High Severity
The PR upgrades react-router to 8.0.1 but leaves react and react-dom at 18.3.1. React Router 8 requires peer react and react-dom at >=19.2.7, so the dev server UI is on an unsupported combination that can break installs, tsc/build, or client routing at runtime.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 4a64919. Configure here.
| }, | ||
| "engines": { | ||
| "node": ">=20.0.0" | ||
| "node": ">=22.22.0" |
There was a problem hiding this comment.
Router eight Node engine mismatch
Medium Severity
react-router@8.0.1 declares engines.node as >=22.22.0, but the dev server UI workflow installs Node via lts/* and package.json does not document or enforce that minimum. Local or CI environments on older Node can hit unsupported installs or subtle build/runtime issues after this bump.
Reviewed by Cursor Bugbot for commit 4a64919. Configure here.
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
- verdict.jq: if each PR finding of a list check (actionlint, golangci-lint, prettier, actions-pinning, npm ls) also occurs on base, the failure is pre-existing. Before, a PR that removed one actionlint finding got a block (#717, #721). - golangci-lint: run with --allow-parallel-runners. A non-zero exit with no finding is incomplete, not a failure with 0 findings. - ui-npm-ci: take the conflict from npm error lines only. An npm warn line named the wrong peer on #729. - deps.py: a package that already had an install script on base adds no new script (esbuild on #779). - ui-dep-usage: join package names with "and". - pr-state: for a conflicting PR, do not say that the checks ran on the PR merged into main. - verify.sh: save the baseline profile. --phase generated and --phase render use it instead of the default profile. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
2 of 3 tasks
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
…old image tags - actions_analysis: evaluate defaults as github.com does. A GHES fallback (github.server_url == 'https://github.com' && X || Y) is X, so the setup-python token default is not a change (#721). The question names the workflows that use the action. - license-changes: one item per package family, which says dev-only build tools: "Accept MPL-2.0 for lightningcss 1.33.0 and 11 lightningcss-* package(s) (dev-only build tools)?" (#779). - verdict.jq: a guard regression or a failing gate already shows that a change reaches ldcli, so the missing discriminating proof is not an incomplete item (#723, #729, #779). - release-snapshot: accept a tagged release image. A conflicting PR is tested at its old head, and trees from before #629 use goreleaser-cross:v1.24.2 instead of a digest (#621). Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
Contributor
Author
|
Superseded by #872. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/internal/dev_server/ui/react-router-8.0.1
branch
October 14, 2026 15:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps react-router from 7.12.0 to 8.0.1.
Release notes
Sourced from react-router's releases.
Changelog
Sourced from react-router's changelog.
... (truncated)
Commits
d10df2dRelease v8.0.1 (#15210)31370cbRemove AppLoadContext (#15207)da102b5Fix globals dependency for lint config (#15208)36122b3Release v8.0.0 (#15198)89b7a8dv8 docs updates (#15199)8fc707dchore: format689981cUse bullet details for trailing slash change notes9acb00eBump react to 19.2.7 (#15191)7e9be69Version 8.0.0-pre.1a3b7eeffix merge conflictYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Medium Risk
Major router upgrade affects all routing (
BrowserRouter,Routes, hooks) with no code migration in the PR, and React 18.3.1 does not satisfy react-router 8’s React ≥19.2.7 peer dependency.Overview
Bumps
react-routerfrom 7.12.0 to 8.0.1 ininternal/dev_server/ui(package.jsonand lockfile only; no app source edits).The lockfile reflects v8’s dependency shift:
cookie/set-cookie-parserare replaced bycookie-es. React Router 8 also raises declared Node (≥22.22.0) and React (≥19.2.7) peer requirements while this package still pins React 18.3.1, so install/build may warn or behave differently until React is upgraded or peers are reconciled.Reviewed by Cursor Bugbot for commit 4a64919. Bugbot is set up for automated code reviews on this repo. Configure here.