fix: bump react-router-dom to ^7.18.0 in web-extension (dependency vulnerabilities)

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-12 (first opened 2026-10-05).
Change type: Major version bump — includes source/config changes to adapt to a breaking change.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
react-router (packages/web-extension, via react-router-dom)	npm	Major	6.30.6 (react-router-dom ^6.4.1) → 7.18.4 (react-router-dom ^7.18.0)	Medium	39d	Wiz	CVE-2026-53666 / GHSA-337j-9hxr-rhxg, CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6

Notes for reviewers:

• Both advisories cover react-router >= 6.x, < 7.18.0 with no 6.x backport, so the 7.x major is the only fix. GHSA-wrjc-x8rr-h8h6 (open redirect via backslash in <Link>/useNavigate) applies to client-side routing, which the extension uses. GHSA-337j-9hxr-rhxg only affects SSR hydration, which the extension doesn't do.
• There's no Dependabot alert because the repo has no committed lockfile (react-router is transitive). Wiz reports it against packages/web-extension/package.json.
• The extension only uses createHashRouter, RouterProvider, Routes, Route, useNavigate and useParams from react-router-dom, and all of them still exist in v7. react-router-dom 7 re-exports react-router, so no import changes were needed.
• One source change: in v7, navigate() returns void | Promise<void>, which makes @typescript-eslint/no-floating-promises fail at packages/web-extension/src/pages/SessionList.tsx. The call is now prefixed with void, so runtime behavior doesn't change.
• web-extension is a private app package with no exported API, so this PR is fix: and not fix!:.
• Related: the nanoid/vitest major batch is in fix: bump nanoid to ^5.1.16 and vitest to ^4.1.11 (dependency vulnerabilities) #40, which also touches packages/web-extension/package.json but a different line, so there's no conflict.
• 2026-10-12: merged main (fix(record): resync replaces grown sheets instead of re-sending the tail #42, which only changes packages/rrweb record code). No new findings for this group.

Deferred / excluded findings

• Covered by open Dependabot PR: svelte (packages/rrweb-player) ^4.2.14 → 5.55.7, Medium, 234d (Dependabot #52–#55, #75, #76). Fully fixed by Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 (^5.56.3).
• In another open automation PR: nanoid and vitest are in fix: bump nanoid to ^5.1.16 and vitest to ^4.1.11 (dependency vulnerabilities) #40.

Verification

• Install: ✅ yarn install resolves react-router/react-router-dom 7.18.4. The only install failure is packages/rrvideo's Playwright browser postinstall, which can't reach the Playwright CDN from the automation sandbox. This happens on main too.
• Build: ✅ yarn build:all passed 22/22 on 2026-10-05, including the chrome and firefox builds of web-extension. Locally, web-extension's manifest schema validation had to be skipped because the sandbox can't fetch the schema. CI runs the full validation. The 2026-10-12 merge from main doesn't touch web-extension.
• Tests: ✅ web-extension has no test suite. The full browser test suite runs in CI on this head.
• Lint: ✅ yarn lint has no new errors. The only errors are the same 3 rrweb-player .svelte parser errors as on main. Without the void change, v7 adds a 4th error (no-floating-promises). yarn check-types passes 34/34 and Prettier is clean.

Link to Devin session: https://app.devin.ai/sessions/68b2679b5727400b96785aa77f9ca237
Open in Devin Desktop: https://app.devin.ai/desktop/session/68b2679b5727400b96785aa77f9ca237?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring