Epic Stack catch-up 1/7: React Router 7.18+ CVE bump

[cursor]

Parent issue: #23

Parent: search for issue titled “Epic Stack catch-up: tracking”.

Goal

Upgrade this app off React Router 7.4.0 (and related packages) far enough to fix the Framework Mode __manifest denial-of-service CVEs. Do not stop at Epic Stack’s 7.16.0.

Why

This site uses React Router Framework Mode (ssr: true in react-router.config.ts). That is the affected mode.

Advisory	Patched in	Notes
CVE-2026-42342 / GHSA-8x6r-g9mw-2r78	react-router 7.15.0+, @remix-run/server-runtime 2.17.5+	Unbounded path expansion on __manifest
CVE-2026-55685 / GHSA-chx6-hx7r-mcp5	react-router 7.18.0+	Follow-up __manifest DoS

Upstream Epic Stack only went to 7.16.0: epicweb-dev/epic-stack#1092 / epicweb-dev/epic-stack@faaa217

Current versions in this repo (package.json):

• react-router ^7.4.0
• @react-router/dev ^7.4.0
• @react-router/node ^7.4.0
• @react-router/express ^7.4.0
• @react-router/remix-routes-option-adapter ^7.4.0 (keep this package; routing migration is package 7)
• @remix-run/server-runtime ^2.16.2

Do this

1. Branch off origin/dev (after dev has been fast-forwarded to main — see parent issue).
2. Bump the React Router family and server runtime to versions that satisfy 7.18.0+ / 2.17.5+. Prefer current patched latest in the 7.x / 2.17+ lines, not a major jump.
3. Keep @react-router/remix-routes-option-adapter in sync with the same 7.x line (still required until package 7).
4. Run npm install so package-lock.json is consistent.
5. Fix compile/test breakage caused by 7.16+ loader args if needed. Epic Stack updated app/routes/_auth/auth.$provider/callback.test.ts for url / pattern on server loader args. This repo’s equivalent is app/routes/_auth+/auth.$provider.callback.test.ts.
6. PR into dev.

Files allowed

• package.json
• package-lock.json
• app/routes/_auth+/auth.$provider.callback.test.ts (only if tests fail after the bump)
• Other test-only files if typecheck/tests fail because of the RR bump — list them in the PR

Do not

• Do not bump Vite, Vitest, Express, Sentry, Prisma, litefs-js, or any other family
• Do not add react-router-auto-routes or react-router-devtools (later packages)
• Do not remove remix-flat-routes or @react-router/remix-routes-option-adapter
• Do not edit dashboard+, marketing copy, fly.toml, .env.example, or localtunnel allowedHosts
• Do not use PR P/patn dev stack updater #21 as a base
• Do not start packages 2–7 in this PR

Acceptance

• Direct deps: react-router and @react-router/* resolve to ≥ 7.18.0; @remix-run/server-runtime to ≥ 2.17.5 (npm ls in the PR body)
• npm run typecheck passes
• npm run test -- --run passes
• npm run lint passes
• Playwright job on the PR is green (or the PR explains a pre-existing flake unrelated to this bump)
• PR targets dev

Staging smoke (human, after merge to dev)

• Hit the staging homepage, login, a notes page, and dashboard
• Confirm the app still boots and auth still works

---

PR target: dev (never main). Implement only this issue.