refactor: Bump react-router from 7.18.1 to 7.18.2

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3428

This is a replacement for the Dependabot pull request #3428. Dependabot branches live in the upstream repository and cannot be modified directly, so the same bump is submitted here from a fork to allow the commit message and PR description to follow the repository conventions.

Approach

Bumps the react-router dependency from 7.18.1 to 7.18.2.

react-router is a production dependency of Parse Dashboard and provides the client-side routing for the dashboard UI (route definitions, navigation and URL handling between the dashboard views).

Upstream changes in react-router 7.18.2 (patch release, 2026-07-28):

• Hardens the CSRF code paths of the React Server Components (RSC) implementation (Backport RSC CSRF hardening to v7 remix-run/react-router#15353, backport of the fix for Request: backport fix to v7 for GHSA-qwww-vcr4-c8h2 remix-run/react-router#15348).
• No other changes are documented for this release; it contains no features, deprecations or breaking changes.

Parse Dashboard does not use the RSC integration, so this is a routine patch-level upgrade that keeps the dependency current rather than a fix for a dashboard-facing defect.

Scope of the diff:

• Only package.json and package-lock.json are modified (5 additions / 5 deletions across 2 files).
• The lockfile churn is confined to the react-router subtree: the pinned version in the root dependency list plus the node_modules/react-router entry (version, resolved, integrity). No transitive dependency versions are added, removed or changed.
• No application source code, configuration or build setup is touched.

Tasks

• Verified the upstream changelog and release notes for react-router 7.18.2

No new tests and no documentation changes are required, as this is a routine dependency version bump that adds no new behavior or public API to Parse Dashboard; the existing test suite covers the affected routing code.

Summary by CodeRabbit

• Chores
  • Updated React Router to version 7.18.2.
  • Refreshed locked dependency metadata for consistent installations.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 84205535-11fc-4c91-9753-c4db181856e7

📥 Commits

Reviewing files that changed from the base of the PR and between 4b257f9 and d1d7c59.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The production react-router dependency is updated from 7.18.1 to 7.18.2. The lockfile records the matching package version, registry URL, and integrity checksum.

Changes

React Router Update

Layer / File(s)	Summary
Align React Router dependency metadata package.json, package-lock.json	The production dependency and lockfile entries update react-router to 7.18.2. The lockfile includes the matching registry URL and integrity checksum.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to d1d7c

This PR updates react-router by one patch version without application-code or configuration changes, so no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: semantic-release-bot

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the allowed refactor: prefix and clearly describes the react-router version upgrade. The first letter of the summary is capitalized.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the dependency bump, scope, upstream changes, testing rationale, and documentation status.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	The change only updates react-router from 7.18.1 to 7.18.2 in package.json and package-lock.json. The GitHub-reviewed advisory GHSA-qwww-vcr4-c8h2 affects 7.12.0 through 7.18.1 and is fixed in 7…
Engage In Review Feedback	✅ Passed	No review feedback required engagement. The current PR is #3438 and contains head commit d1d7c59. GitHub reports zero submitted reviews and zero inline review comments for #3438. Its issue comments co…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Security Check

Explanation

The change only updates react-router from 7.18.1 to 7.18.2 in package.json and package-lock.json. The GitHub-reviewed advisory GHSA-qwww-vcr4-c8h2 affects 7.12.0 through 7.18.1 and is fixed in 7.18.2. OSV reports the advisory for 7.18.1 and no vulnerabilities for 7.18.2. The lockfile uses the HTTPS npm registry URL and an integrity hash that matches the public npm metadata. No application code or new security-sensitive pattern was introduced.

Full details: Engage In Review Feedback

Explanation

No review feedback required engagement. The current PR is #3438 and contains head commit d1d7c59. GitHub reports zero submitted reviews and zero inline review comments for #3438. Its issue comments contain only automated notices, a CodeRabbit review-in-progress/result message stating that no actionable comments were generated, and the author's request to run a full review. The linked Dependabot PR #3428 also has zero issue comments, reviews, and review comments. Therefore, no feedback was ignored or resolved without discussion or a corrective commit.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[mtrezza]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.