Move to react-router 7.18 (#76)

Every 6.x release is inside both open advisories, so no 6.x update closes
them: GHSA-wrjc-x8rr-h8h6 (open redirect via a backslash in <Link> and
useNavigate) and GHSA-337j-9hxr-rhxg (SSR hydration; not reachable here,
this is a client-only HashRouter app). 7.18 in library mode keeps every API
the app imports (Routes, Route, Link, NavLink, Navigate, useLocation,
useParams, HashRouter, MemoryRouter) and bundles @remix-run/router.

The one behaviour v7 changes, relative links under splat routes, does not
occur: no route path ends in '*', tab links are absolute (basePath) and the
top level picks the page from location.pathname.

Measured: 17 routes opened in Chromium against the live 6.x build and this
build give the same URL, active tab, tab count and tab-click target, with no
page errors. Tests 89/89, lint and type check green.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

packages/react-components/package.json

@@ -41,8 +41,8 @@
     "react-dropzone": "^14.2.3",
     "react-i18next": "^13.5.0",
     "react-markdown": "^9.0.1",
-    "react-router": "^6.21.0",
-    "react-router-dom": "^6.21.0",
+    "react-router": "^7.18.0",
+    "react-router-dom": "^7.18.0",
     "react-tooltip": "^4.5.1",
     "rehype-raw": "^7.0.0",
     "semantic-ui-css": "^2.5.0",

yarn.lock

@@ -2745,8 +2745,8 @@ __metadata:
     react-dropzone: "npm:^14.2.3"
     react-i18next: "npm:^13.5.0"
     react-markdown: "npm:^9.0.1"
-    react-router: "npm:^6.21.0"
-    react-router-dom: "npm:^6.21.0"
+    react-router: "npm:^7.18.0"
+    react-router-dom: "npm:^7.18.0"
     react-tooltip: "npm:^4.5.1"
     rehype-raw: "npm:^7.0.0"
     semantic-ui-css: "npm:^2.5.0"
@@ -5694,13 +5694,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@remix-run/router@npm:1.23.4":
-  version: 1.23.4
-  resolution: "@remix-run/router@npm:1.23.4"
-  checksum: 10/1b7dd04465a542a8110ee398195ac4b9ac1de5521312f9953041874f0295bf64ff224a0ff88ff36a91c88004529667f566b95fdf94b35fc26b17b1f0d61f03d8
-  languageName: node
-  linkType: hard
-
 "@rollup/plugin-alias@npm:^5.1.1":
   version: 5.1.1
   resolution: "@rollup/plugin-alias@npm:5.1.1"
@@ -9703,6 +9696,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cookie@npm:^1.0.1":
+  version: 1.1.1
+  resolution: "cookie@npm:1.1.1"
+  checksum: 10/85538153054791155cf4d38d2e807e3b9382d71bf71d92fc46fca348515ea574049d0d9ef8eb84d2d54a681ad1d7a7316b1989b901dace50a6c0f4c3858dbdb2
+  languageName: node
+  linkType: hard
+
 "cookie@npm:~0.7.1":
   version: 0.7.2
   resolution: "cookie@npm:0.7.2"
@@ -17707,27 +17707,31 @@ __metadata:
   languageName: node
   linkType: hard
 
-"react-router-dom@npm:^6.21.0":
-  version: 6.30.6
-  resolution: "react-router-dom@npm:6.30.6"
+"react-router-dom@npm:^7.18.0":
+  version: 7.18.4
+  resolution: "react-router-dom@npm:7.18.4"
   dependencies:
-    "@remix-run/router": "npm:1.23.4"
-    react-router: "npm:6.30.6"
+    react-router: "npm:7.18.4"
   peerDependencies:
-    react: ">=16.8"
-    react-dom: ">=16.8"
-  checksum: 10/6e501c45fd85894b197a84437c12cd0ab6d9c14277af41a7546f965ee0a0861aff1da5d72d56020a1ac2d4d4b1c4ec848a16554372004fdef5cdb1bce75a155e
+    react: ">=18"
+    react-dom: ">=18"
+  checksum: 10/d1f9ccaacbd19704312b954ac731648f590cced3a310ce46a14b987a712758b4357f779e3c31331e8d3d9f8cead994aa32c2ca762a130c4e37648f3f764205fd
   languageName: node
   linkType: hard
 
-"react-router@npm:6.30.6, react-router@npm:^6.21.0":
-  version: 6.30.6
-  resolution: "react-router@npm:6.30.6"
+"react-router@npm:7.18.4, react-router@npm:^7.18.0":
+  version: 7.18.4
+  resolution: "react-router@npm:7.18.4"
   dependencies:
-    "@remix-run/router": "npm:1.23.4"
+    cookie: "npm:^1.0.1"
+    set-cookie-parser: "npm:^2.6.0"
   peerDependencies:
-    react: ">=16.8"
-  checksum: 10/df751de74dc460abc9023aecfd09284170939e8ad8892373ec0015aa04187e0b9c66fffcb546bfb0f1ca5c9edb14b67c93a46306a61efcf15a7dc20eca1e16b7
+    react: ">=18"
+    react-dom: ">=18"
+  peerDependenciesMeta:
+    react-dom:
+      optional: true
+  checksum: 10/2c4c6e23a38fe5994b126d55590f6dbfe810d47939b765cd7af97b4b26a16c3dab20c1b048811e05dc74bc93787a3d0c3fc5f29df19fd0732059cccc6bf7180a
   languageName: node
   linkType: hard
 
@@ -18701,6 +18705,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"set-cookie-parser@npm:^2.6.0":
+  version: 2.7.2
+  resolution: "set-cookie-parser@npm:2.7.2"
+  checksum: 10/4b6f5ec4e3fa1aef471d9207117704d217ba6bb6443400b41f5ea945c4a7f6fc08e405a122c1a32b4ebde41f06dea75e02c2af87cee9abb27f3e3fe911e5839b
+  languageName: node
+  linkType: hard
+
 "set-function-length@npm:^1.2.2":
   version: 1.2.2
   resolution: "set-function-length@npm:1.2.2"