fix: bump react-router-dom to ^7.18.0 in web-extension (dependency vulnerabilities)

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-05.
Change type: Major version bump — includes source/config changes to adapt to a breaking change.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
react-router (packages/web-extension, via react-router-dom)	npm	Major	6.30.6 (react-router-dom ^6.4.1) → 7.18.4 (react-router-dom ^7.18.0)	Medium	32d	Wiz	CVE-2026-53666 / GHSA-337j-9hxr-rhxg, CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6

Notes for reviewers:

• Both advisories cover react-router >= 6.x, < 7.18.0 with no 6.x backport, so the 7.x major is the only fix. GHSA-wrjc-x8rr-h8h6 (open redirect via backslash in <Link>/useNavigate) applies to client-side routing, which the extension uses. GHSA-337j-9hxr-rhxg only affects SSR hydration, which the extension doesn't do.
• There's no Dependabot alert because the repo has no committed lockfile (react-router is transitive). Wiz reports it against packages/web-extension/package.json.
• The extension only uses createHashRouter, RouterProvider, Routes, Route, useNavigate and useParams from react-router-dom, and all of them still exist in v7. react-router-dom 7 re-exports react-router, so no import changes were needed.
• One source change: in v7, navigate() returns void | Promise<void>, which makes @typescript-eslint/no-floating-promises fail at packages/web-extension/src/pages/SessionList.tsx. The call is now prefixed with void, so runtime behavior doesn't change.
• web-extension is a private app package with no exported API, so this PR is fix: and not fix!:.
• Related: the nanoid/vitest major batch is in fix: bump nanoid to ^5.1.16 and vitest to ^4.1.11 (dependency vulnerabilities) #40, which also touches packages/web-extension/package.json but a different line, so there's no conflict.

Deferred / excluded findings

• Covered by open Dependabot PR: svelte (packages/rrweb-player) ^4.2.14 → 5.55.7, Medium, 227d (Dependabot #52–#55, #75, #76). Fully fixed by Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 (^5.56.3), which has green CI.
• In another open automation PR: nanoid and vitest are in fix: bump nanoid to ^5.1.16 and vitest to ^4.1.11 (dependency vulnerabilities) #40.

Verification

• Install: ✅ yarn install resolves react-router/react-router-dom 7.18.4. The only install failure is packages/rrvideo's Playwright browser postinstall, which can't reach the Playwright CDN from the automation sandbox. This happens on main too.
• Build: ✅ yarn build:all passes 22/22, including the chrome and firefox builds of web-extension. Locally, web-extension's manifest schema validation had to be skipped because the sandbox can't fetch the schema. CI runs the full validation.
• Tests: ✅ web-extension has no test suite, and no other package changed. The full browser test suite runs in CI.
• Lint: ✅ yarn lint has no new errors. The only errors are the same 3 rrweb-player .svelte parser errors as on main. Without the void change, v7 adds a 4th error (no-floating-promises). yarn check-types passes 34/34 and Prettier is clean.

Link to Devin session: https://app.devin.ai/sessions/f0e11a0113ee4897821aa7d14857174d
Open in Devin Desktop: https://app.devin.ai/desktop/session/f0e11a0113ee4897821aa7d14857174d?variant=devin

---

Note

Overview
Upgrades react-router-dom in the web extension from v6 to ^7.18.0 to address medium-severity routing advisories (including client-side open-redirect issues) where no patched 6.x release exists.

The only code adaptation is prefixing the session table row navigate() call with void in SessionList.tsx, because v7 types navigate as possibly returning a promise and the existing lint rule flags an unhandled promise; behavior is unchanged.

^{Reviewed by Cursor Bugbot for commit e5de2d0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring