fix(deps): update dependency react-router-dom to v6.30.5 [security] - #160

Open

renovate[bot] wants to merge 1 commit into

mainfrom

renovate/npm-react-router-dom-vulnerability

renovate Bot commented Aug 18, 2026

Contributor

This PR contains the following updates:

Package	Change	Age	Confidence
react-router-dom (source)	`6.30.4` → `6.30.5`
react-router-dom (source)	`^6` → `^6.30.5`

React Router: Open redirect leading to XSS

CVE-2026-53668 / GHSA-jjmj-jmhj-qwj2

More information

Details

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

remix-run/react-router (react-router-dom)

`v6.30.4`

`v6.30.3`

`v6.30.2`

`v6.30.1`

`v6.30.0`

`v6.29.0`

`v6.28.2`

`v6.28.1`

`v6.28.0`

`v6.27.0`

`v6.26.2`

`v6.26.1`

`v6.26.0`

`v6.25.1`

`v6.25.0`

`v6.24.1`

`v6.24.0`

`v6.23.1`

`v6.23.0`

`v6.22.3`

`v6.22.2`

`v6.22.1`

`v6.22.0`

`v6.21.3`

`v6.21.2`

`v6.21.1`

`v6.21.0`

`v6.20.1`

`v6.20.0`

`v6.19.0`

`v6.18.0`

`v6.17.0`

`v6.16.0`

`v6.15.0`

`v6.14.2`

`v6.14.1`

`v6.14.0`

`v6.13.0`

`v6.12.1`

`v6.12.0`

`v6.11.2`

`v6.11.1`

`v6.11.0`

`v6.10.0`

`v6.9.0`

`v6.8.2`

`v6.8.1`

`v6.8.0`

`v6.7.0`

`v6.6.2`

`v6.6.1`

`v6.6.0`

`v6.5.0`

`v6.4.5`

`v6.4.4`: v6.4.4

What's Changed

Throw an error if an action/loader function returns undefined as revalidations need to know whether the loader has previously been executed. undefined also causes issues during SSR stringification for hydration. You should always ensure your loader/action returns a value, and you may return null if you don't wish to return anything. (#9511)
Properly handle redirects to external domains (#9590, #9654)
Preserve the HTTP method on 307/308 redirects (#9597)
Support basename in static data routers (#9591)
Enhanced ErrorResponse bodies to contain more descriptive text in internal 403/404/405 scenarios
Fix issues with encoded characters in NavLink and descendant <Routes> (#9589, #9647)
Properly serialize/deserialize ErrorResponse instances when using built-in hydration (#9593)
Support basename in static data routers (#9591)
Updated dependencies:
- @remix-run/router@1.0.4
- react-router@6.4.4

Full Changelog: https://github.com/remix-run/react-router/compare/react-router-dom@6.4.3...react-router-dom@6.4.4

`v6.4.3`

`v6.4.2`

`v6.4.1`

`v6.4.0`

`v6.3.0`

`v6.2.2`

`v6.2.1`

`v6.2.0`

`v6.1.1`

`v6.1.0`

`v6.0.2`

✨ Features

Added the reloadDocument prop to <Link>. This allows <Link> to function like a normal anchor tag by reloading the document after navigation while maintaining the relative to resolution.

🗒️ Docs

Fixed several issues in docblocks and the docs themselves. See the full changelog for the deets!

🤝 New Contributors

@rwieruch made their first contribution in #8244
@ProProgrammer2504 made their first contribution in #8247
@Sannnao made their first contribution in #8263
@mattmazzola made their first contribution in #8255
@ngokevin made their first contribution in #8267
@TimisRobert made their first contribution in #8269
@mikeldking made their first contribution in #8279
@fishmandev made their first contribution in #8289

Full Changelog

`v6.0.1`

🐛 Bug Fixes

Add a default <StaticRouter location> value (#8243)
Add invariant for using <Route> inside <Routes> to help people make the change (#8238)

Configuration

📅 Schedule: (in timezone US/Eastern)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          fix(deps): update dependency react-router-dom to v6.30.5 [security]

bb16e81

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet