[dependabot]

Bumps react-router from 7.18.4 to 8.5.1.

Release notes

Sourced from react-router's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

v8.5.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v850

v8.4.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v840

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.5

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7185

Changelog

Sourced from react-router's changelog.

v8.5.1

Patch Changes

• Fix URIError: URI malformed when an ssr: false dev server receives a URL path with a malformed percent-encoding (#15649)
• Bound server route manifest processing for paths with expensive route expansion (#15703)
  • Fall back to initial route discovery during server rendering and RSC document/data requests
  • Account for the number and depth of candidate branches when using regex matching
• Encode commas within paths sent to the lazy route discovery manifest endpoint so routes with commas in their paths are discovered correctly (#15640)
• Fix fetcher revalidation errors bubbling to the root error boundary instead of the nearest boundary above the route that owns the fetcher (#15676)
• Avoid duplicate history entries when posting a <Form> to the current URL with an encoded action (#15679)
  • Replace the current history entry when the action contains characters that get percent-encoded, such as spaces or non-ASCII characters
• Fix an unhandled promise rejection when the browser skips a viewTransition navigation, for example in a hidden tab (#15582)
• Bubble rejected lazy.Component imports on loader-less routes to the nearest error boundary (#15658)
  • Render the error boundary instead of a blank page
• Preserve pending fetcher mutation revalidation when an older navigation or background reload completes to prevent stale loader data (#15686)
  • Keep newer fetcher loads cancellable and preserve them when earlier revalidations finish or abort, preventing older responses from overwriting fresh fetcher data
• Retry rejected lazy route imports instead of caching failures permanently (#15689)
• Revalidate loader data when a fetcher action redirect is not followed (#15557)
  • Revalidate when an action redirect is ignored because a newer navigation started or the fetcher unmounted while the action was running
  • Include shared parent loaders when another navigation completed while the action was running
  • Continue to respect shouldRevalidate
  • Return fetchers to idle when a revalidation completes a pending navigation started by another fetcher's redirect
• Avoid adding an incompatible document.startViewTransition() overload to the global Document type (#15680)
  • Allow transition results to be assigned to the DOM ViewTransition type
• Skip deleteData in destroySession when the session has no ID (#15639)
  • Avoid failures when destroying a session without a cookie on storage that rejects an empty key
• Surface the host's 404 response when a SPA fallback route has no prerendered data (#15646)
  • Request single-fetch .data files for hydrating routes with a server loader in an ssr: false app with a prerender config
  • Avoid the internal "No result found for routeId" error for non-prerendered parameterized paths served via the SPA fallback
• Improve turbo-stream decoding validation and object property handling (18e1fbd)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Add an opt-in <Await unstable_promise={promise}> implementation based on React's use() API (#15678)
  • Use React.use instead of React Router's internal promise tracking
  • Accept promise-like values and retain errorElement, useAsyncValue, and useAsyncError support
  • Handle only promise rejections with errorElement when using unstable_promise, allowing child render errors to bubble to the nearest React error boundary
  • Track streamed promises during decoding so settled server content stays visible during hydration updates with either Await API or direct React.use()
• Fix URIError: URI malformed when an API-only (ssr: "unstable_api-only") server receives a URL path with a malformed percent-encoding (#15649)
• Fix duplicate headers when throwing a redirect from an RSC server function (#15667)

v8.5.0

Minor Changes

• Deprecate React Router's view transition APIs in favor of React's <ViewTransition> component, available in React 19.3 and later (#15493)
  • Deprecate the viewTransition props/options, useViewTransitionState, and NavLink's isTransitioning render prop and transitioning class

... (truncated)

Commits

• a2783e6 Release v8.5.1 (#15656)
• 69465b0 docs: prepare 8.5.1 release notes
• 393d7c1 Bound server route manifest processing (#15703)
• 18e1fbd Improve turbo-stream decoding validation and object property handling
• cc0b62e Add Await unstable_promise and preserve streamed content during hydration (#1...
• a7db797 fix(react-router): retry rejected lazy route imports (#15689)
• 3ef3def fix(react-router): preserve pending mutation revalidation (#15686)
• 6cdc3fa fix(react-router): revalidate when an ignored fetcher action redirect is not ...
• b0a4477 chore: format
• 4f788db Fix 404 on hard load of non-prerendered param route served via SPA fallback (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@remix-run/route-pattern	0.22.1	🟢 5.6	Details Check Score Reason Code-Review ⚠️ 1 Found 5/30 approved changesets -- score normalized to 1 Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/cookie-es	3.1.1	Unknown	Unknown
npm/react-router	8.5.1	🟢 5.9	Details Check Score Reason Code-Review 🟢 3 Found 9/25 approved changesets -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• pnpm-lock.yaml

[SebastianLopezO]

Revisado: se acepta. React Router 8 exige Node 22.22+ y React 19.2.7+ (el proyecto usa React 19.3.1 y construye con Node 22/24), elimina react-router-dom (aquí todo se importa de react-router) y vuelve por defecto los future flags del modo framework (loaders, middleware, Vite), que esta app no usa: es modo librería con createBrowserRouter, RouterProvider, Link, NavLink, Navigate, Outlet y los hooks de navegación. Build y las pruebas de rutas y páginas pasan con Node 22 y 24. El único check en rojo es security/snyk (SmartPot): la app de Snyk agotó su cuota de pruebas privadas; no lo causa este cambio (el workflow de Snyk del repositorio pasa).