Skip to content

Update dependency react-router to v5#30

Open
dev-mend-for-fd.fxlcf.dpdns.org[bot] wants to merge 1 commit intoalphafrom
whitesource-remediate/react-router-5.x
Open

Update dependency react-router to v5#30
dev-mend-for-fd.fxlcf.dpdns.org[bot] wants to merge 1 commit intoalphafrom
whitesource-remediate/react-router-5.x

Conversation

@dev-mend-for-fd.fxlcf.dpdns.org

This PR contains the following updates:

Package Type Update Change
react-router (source) dependencies major 4.x5.x

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score Vulnerability Reachability
High High 7.5 CVE-2024-45296

Release Notes

remix-run/react-router (react-router)

v5.0.0

Compare Source

Note: While this does have a major version bump, it is actually a minor release. We screwed up some of the dependency version selection in 4.3.1, which necessitated a major bump. See this blog post for details.
⚠️ Upgrade Warning ⚠️

Please ensure you have upgraded both react-router and react-router-dom (react-router-native for RN users) to the exact same version. If different versions of those two packages are in your application, you will get errors when using <Link> and other react-router-dom-specific components. You can ensure you have the correct versions of both packages in your app using npm ls react-router react-router-dom.

Breaking Changes

  • Since the old context API is no longer used, any access to the old context will fail. Use of the react router context is not supported, please use withRouter() or a <Route/> instead.
  • Due to the new context API, mixing of imports will now result in an exception:
// Be careful, this won't work anymore!
import BrowserRouter from 'react-router-dom/BrowserRouter';
import { Route } from 'react-router-dom';

<BrowserRouter>
  <Route />
</BrowserRouter>

Refactor as follows:

// These are both from the same build and use the same context object
// so there won't be a mismatch :)
import { BrowserRouter, Route } from 'react-router-dom';
  • In development mode, we now throw an error when using 2 different builds (see b2c6fa0), i.E. combining CJS imports with ESM imports.

New Features

<Route path={["/BigApple", "/NYC", "NewYork"]} component={NewYork} />

Full Changelog

  • <Route /> now supports multiple child nodes when using react >= 16.0.
  • Migrated to new react context API, with a polyfill for react versions < 16.2
  • Removed deprecated lifecycle methods componentWillMount and componentWillReceiveProps
  • Introduced more warnings in development builds
  • Changed build-process to rollup:
    • Smaller build size
    • Package now includes pre-minified files
    • Package now consists of single-file builds that include all modules.
  • Upgraded to history 4.9.0
  • Per file imports are deprecated and will be removed in a future major version. For now, a warning will be logged.
  • Made sure that react router conforms to react <StrictMode/>
  • Fixed <Link /> not working properly with target="_self" - #​6138 (thanks @​ericyang89)
  • Fixed prop-type warning when using forwardRef - #​6417 (thanks @​frehner and @​eXon)
  • Added support for createRef in - #​6567 (thanks @​gcangussu)
  • Removed use of eval in development to be compliant with unsafe-eval CSP - #​6611
  • Migrated to babel-preset-env
  • Improved testing infrastructure to improve developer workflow
  • Several docs improvements - #​6410 (thanks @​justsml)

  • If you want to rebase/retry this PR, check this box

@dev-mend-for-fd.fxlcf.dpdns.org dev-mend-for-fd.fxlcf.dpdns.org bot added the security fix Security fix generated by Mend label Mar 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants