chore(deps): bump the npm_and_yarn group across 24 directories with 12 updates

[dependabot]

Bumps the npm_and_yarn group with 10 updates in the /docs directory:

Package	From	To
brace-expansion	1.1.14	1.1.16
dompurify	3.4.3	3.4.12
fast-uri	3.1.2	3.1.4
http-proxy-middleware	2.0.9	2.0.10
js-yaml	3.14.2	3.15.0
linkify-it	5.0.0	5.0.2
shell-quote	1.8.3	1.10.0
svgo	3.3.3	3.3.4
tar	7.4.3	7.5.22
websocket-driver	0.7.4	0.7.5

Bumps the npm_and_yarn group with 1 update in the /examples/complex directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /examples/empty directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /examples/getstarted directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /examples/kitchensink directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /examples/kitchensink-ts directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/cli/cloud directory: tar.
Bumps the npm_and_yarn group with 1 update in the /packages/cli/create-strapi-app directory: tar.
Bumps the npm_and_yarn group with 1 update in the /packages/core/admin directory: react-router-dom.
Bumps the npm_and_yarn group with 2 updates in the /packages/core/content-manager directory: dompurify and react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/core/content-releases directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/core/content-type-builder directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/core/data-transfer directory: tar.
Bumps the npm_and_yarn group with 1 update in the /packages/core/email directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/core/review-workflows directory: react-router-dom.
Bumps the npm_and_yarn group with 2 updates in the /packages/core/upload directory: react-router-dom and sharp.
Bumps the npm_and_yarn group with 1 update in the /packages/plugins/cloud directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/plugins/color-picker directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/plugins/documentation directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/plugins/graphql directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/plugins/i18n directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/plugins/sentry directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /packages/plugins/users-permissions directory: react-router-dom.
Bumps the npm_and_yarn group with 1 update in the /tests/app-template directory: react-router-dom.

Updates brace-expansion from 1.1.14 to 1.1.16

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• 2203f4f 1.1.15
• 0b09384 Backport v5.0.6 change to v1 (#111)
• See full diff in compare view

Updates dompurify from 3.4.3 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
• Removed a problem leading to permanent hook pollution, thanks @​offset
• Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

• Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
• Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde

... (truncated)

Commits

• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

• 6aeece6 Bumped v3.1.4
• 2d50fba fix: reject literal backslash in URI authority
• 0549fe3 Bumped v3.1.3
• 2a6d357 Merge commit from fork
• See full diff in compare view

Updates http-proxy-middleware from 2.0.9 to 2.0.10

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.10-beta.0

What's Changed

• fix: harden proxy-table matching to prevent routing bypass by @​G-Rath in chimurai/http-proxy-middleware#1268
• ci(github-actions): update publish.yml by @​chimurai in chimurai/http-proxy-middleware#1270

New Contributors

• @​G-Rath made their first contribution in chimurai/http-proxy-middleware#1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10-beta.0

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.10

• fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass

Commits

• f0be839 chore(package.json): v2.0.10 (#1271)
• 19c860d ci(github-actions): update publish.yml (#1270)
• d0f7d63 fix: harden proxy-table matching to prevent routing bypass (#1268)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.

Updates js-yaml from 3.14.2 to 3.15.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• d8ff750 Add package lock
• 24f13e7 Added maxTotalMergeKeys (10000) loader option (v5 backport)
• See full diff in compare view

Updates linkify-it from 5.0.0 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

• Fixed DoS in mailto: links (restrict user name to 64 chars).
• Restricted user/pass part length in links.

5.0.1 / 2026-05-23

• Fixed DoS in fuzzy links/emails search.
• Reworked search logic - check each pattern separate, use g regexes instead of slice.
• Removed internal cache - useless overcomplication.

Commits

• 50a0c91 5.0.2 released
• de3b885 Update package hooks
• 13effaa Add package lock
• 39d748d Bump c8
• 00ce877 Drop tlds deps
• ecde823 Update benchmark to mitata
• 23c62cd Refactor demo / doc build and publish
• fd63f3b CI config update
• f4ea5af demo: update bootstrap & layout
• 1454fb6 lint: dim warnings
• Additional commits viewable in compare view

Updates shell-quote from 1.8.3 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
• [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
• [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
• [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
• [readme] document parse's supported parameter-expansion subset e1c75cd
• [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
• [readme] fix stale example outputs 2de86f5
• [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
• [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
• [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
• [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
• [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
• [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
• [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

Commits

• 64988d9 v1.10.0
• 617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
• 59bbf8b [types] fix an error TS v6 ignores but v7 fails on
• 190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
• a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
• b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
• 1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
• 1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
• e1c75cd [readme] document parse's supported parameter-expansion subset
• c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
• Additional commits viewable in compare view

Updates svgo from 3.3.3 to 3.3.4

Release notes

Sourced from svgo's releases.

v3.3.4

What's Changed

Security

• removeScriptElement, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @​SethFalco

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

Commits

• 72a2388 Merge commit from fork
• See full diff in compare view

Updates tar from 7.4.3 to 7.5.22

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates websocket-driver from 0.7.4 to 0.7.5

Changelog

Sourced from websocket-driver's changelog.

0.7.5 / 2026-06-04

• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Fail the connection if a message is larger than the configured max length after extension processing

Commits

• 5d6a9aa Bump version to 0.7.5
• c55679a Fail the connection if a message is larger than the configured max length aft...
• 5b197ca Close a draft-75/76 connection if a length header grows to exceed the configu...
• fc93a48 Test on Node v22, v24, and v26
• 2e82d34 Test on recent versions of Node
• e4962db Switch from Travis CI to GitHub Actions
• 3f2f9b7 Travis update: cache npm modules, remove sudo, run on Node 15
• See full diff in compare view

Updates react-router-dom from 6.30.3 to 7.0.0

Changelog

Sourced from react-router-dom's changelog.

7.0.0

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,

• Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#11469)

• Remove single_fetch future flag. (#11522)

• Remove future.v7_startTransition flag (#11696)

• Remove future.v7_normalizeFormMethod future flag (#11697)

• Allow returning undefined from actions and loaders (#11680)

• update minimum node version to 18 (#11690)

• Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#11726)

• Remove future.v7_throwAbortReason from internalized @remix-run/router package (#11728)

• Add exports field to all packages (#11675)

• node package no longer re-exports from react-router (#11702)

• updates the minimum React version to 18 (#11689)

• • Remove the future.v7_partialHydration flag (#11725)
    • This also removes the <RouterProvider fallbackElement> prop
      • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
    • Also worth nothing there is a related breaking changer with this future flag:
      • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
      • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

• Remove future.v7_fetcherPersist flag (#11731)

Minor Changes

• Add prefetching support to Link/NavLink when using Remix SSR (#11402)
• Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#11401)
• Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#11396) (#11400)

Patch Changes

... (truncated)

Commits

• e8e3b00 chore: Update version for release (#12344)
• 1499f3e chore: Update version for release (pre) (#12315)
• 995bcbb chore: Update version for release (pre) (#12235)
• 0e9b346 chore: Update version for release (pre) (#12205)
• 6576bd0 chore: Update version for release (pre) (#12202)
• 8daac72 Merge branch 'dev' into release-next
• 2d5924f feat: configure export conditions properly (#12136)
• 18dc8b8 chore: Update version for release (pre) (#12184)
• fde6951 Merge branch 'dev' into release-next
• 813497a Drop support for Node 18 and installGlobals (#12171)
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (6.30.3) was attested. Review the package versions before updating.

Updates react-router-dom from 6.30.3 to 7.0.0

Changelog

Sourced from react-router-dom's changelog.

7.0.0

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,

• Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#11469)

• Remove single_fetch future flag. (#11522)

• Remove future.v7_startTransition flag (#11696)

• Remove future.v7_normalizeFormMethod future flag (#11697)

• Allow returning undefined from actions and loaders (#11680)

• update minimum node version to 18 (#11690)

• Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#11726)

• Remove future.v7_throwAbortReason from internalized @remix-run/router package (#11728)

• Add exports field to all packages (#11675)

• node package no longer re-exports from react-router (#11702)

• updates the minimum React version to 18 (#11689)

• • Remove the future.v7_partialHydration flag (#11725)
    • This also removes the <RouterProvider fallbackElement> prop
      • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
    • Also worth nothing there is a related breaking changer with this future flag:
      • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
      • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

• Remove future.v7_fetcherPersist flag (#11731)

Minor Changes

• Add prefetching support to Link/NavLink when using Remix SSR (#11402)
• Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#11401)
• Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#11396) (#11400)

Patch Changes

... (truncated)

Commits

• e8e3b00 chore: Update version for release (#12344)
• 1499f3e chore: Update version for release (pre) (#12315)
• 995bcbb chore: Update version for release (pre) (#12235)
• 0e9b346 chore: Update version for release (pre) (#12205)
• 6576bd0 chore: Update version for release (pre) (#12202)
• 8daac72 Merge branch 'dev' into release-next
• 2d5924f feat: configure export conditions properly (#12136)
• 18dc8b8 chore: Update version for release (pre) (#12184)
• fde6951 Merge branch 'dev' into release-next
• 813497a Drop support for Node 18 and installGlobals (#12171)
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (6.30.3) was attested. Review the package versions before updating.

Updates react-router-dom from 6.30.3 to 7.0.0

Changelog

Sourced from react-router-dom's changelog.

7.0.0

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,

• Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#11469)

• Remove single_fetch future flag. (#11522)

• Remove future.v7_startTransition flag (#11696)

• Remove future.v7_normalizeFormMethod future flag (#11697)

• Allow returning undefined from actions and loaders (#11680)

• update minimum node version to 18 (#11690)

• Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#11726)

• Remove future.v7_throwAbortReason from internalized @remix-run/router package (#11728)

• Add exports field to all packages (#11675)

• node package no longer re-exports from react-router (#11702)

• updates the minimum React version to 18 (#11689)

• • Remove the future.v7_partialHydration flag (#11725)
    • This also removes the <RouterProvider fallbackElement> prop
      • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
    • Also worth nothing there is a related breaking changer with this future flag:
      • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
      • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

• Remove future.v7_fetcherPersist flag (#11731)

Minor Changes

• Add prefetching support to Link/NavLink when using Remix SSR (#11402)
• Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#11401)
• Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#11396) (#11400)

Patch Changes

... (truncated)

Commits

• e8e3b00 chore: Update version for release (#12344)
• 1499f3e chore: Update version for release (pre) (#12315)
• 995bcbb chore: Update version for release (pre) (#12235)
• 0e9b346 chore: Update version for release (pre) (#12205)
• 6576bd0 chore: Update version for release (pre) (#12202)
• 8daac72 Merge branch 'dev' into release-next
• 2d5924f feat: configure export conditions properly (#12136)
• 18dc8b8 chore: Update version for release (pre) (#12184)
• fde6951 Merge branch 'dev' into release-next
• 813497a Drop support for Node 18 and installGlobals (#12171)
• Additional commits viewable in <...

  Description has been truncated