Bump React Router to 7.18.2 for __manifest DoS CVEs

[goodeats]

Closes #24

Upgrade this app off React Router 7.4.0 far enough to fix the Framework Mode __manifest denial-of-service CVEs. This does not stop at Epic Stack’s 7.16.0.

Advisory	Patched in
CVE-2026-42342	react-router 7.15.0+, @remix-run/server-runtime 2.17.5+
CVE-2026-55685	react-router 7.18.0+

Summary

• Bump react-router and @react-router/* from ^7.4.0 to ^7.18.2 (latest patched 7.x; not a major jump to 8.x)
• Bump @remix-run/server-runtime from ^2.16.2 to ^2.17.5
• Keep @react-router/remix-routes-option-adapter on the same 7.x line
• Keep remix-flat-routes; do not add react-router-auto-routes or react-router-devtools
• Update loader test args for the 7.16+ required url / pattern fields on LoaderFunctionArgs
• 7.18 typegen no longer exports Info from +types modules. Replace those compile-only imports with Route.ComponentProps['loaderData' | 'actionData'] so tsc passes. No dashboard CRUD or marketing copy changes.
• First Playwright run on this PR got past browser install, then failed collection by parsing sprite.svg as JS. Stub Vite .svg imports in the Playwright Babel transform only.

npm ls (direct deps)

react-router@7.18.2
@react-router/dev@7.18.2
@react-router/express@7.18.2
@react-router/node@7.18.2
@react-router/remix-routes-option-adapter@7.18.2
@remix-run/server-runtime@2.17.5

Intentionally not bumped

Vite 6.2.2, Vitest 3.0.9, Express 4.21.2, Sentry 9.8.0, Prisma 6.5.0, litefs-js 1.1.2, and routing migration (packages 2–7 / issues 25–30). Not based on PR #21.

Files changed

Allowed by the issue:

• package.json
• package-lock.json
• app/routes/_auth+/auth.$provider.callback.test.ts (loader args now require url and pattern)
• app/routes/users+/$username.test.tsx (same LoaderFunctionArgs requirement; test-only)

Required for typecheck after the 7.18 typegen Info export removal (listed per the parent issue’s compile-breakage rule):

• app/routes/_marketing+/index.tsx (type imports only)
• app/routes/dashboard+/__about-editor.tsx
• app/routes/dashboard+/__contact-editor.tsx
• app/routes/dashboard+/__layout.tsx
• app/routes/dashboard+/__project-editor.tsx
• app/routes/dashboard+/__project-skills-editor.tsx
• app/routes/dashboard+/__skill-editor.tsx
• app/routes/dashboard+/about.index.tsx
• app/routes/dashboard+/contacts.index.tsx
• app/routes/dashboard+/projects.index.tsx
• app/routes/dashboard+/skills.index.tsx
• app/routes/settings+/profile.connections.tsx
• app/routes/settings+/profile.index.tsx
• app/routes/users+/$username_+/__note-editor.tsx
• app/routes/users+/$username_+/notes.$noteId.tsx
• app/routes/users+/$username_+/notes.index.tsx

Required for Playwright after the bump (test-only):

• playwright.config.ts
• tests/svg-import-stub.cjs

Test Plan

• Direct deps resolve to react-router / @react-router/* ≥ 7.18.0 and @remix-run/server-runtime ≥ 2.17.5
• npm run typecheck (local + CI)
• npm run test -- --run (local + CI)
• npm run lint (local + CI; existing unused-var warning in app/root.tsx only)
• npm run build (local; Vite remains 6.2.2)
• Playwright:
  • First PR run: browsers installed, then collection failed on sprite.svg SyntaxError / “No tests found”. Addressed with the test-only SVG stub.
  • Current PR run and origin/dev push run: both stuck ~60 minutes on Install Playwright Browsers and then cancelled. That hang is a pre-existing CI flake unrelated to this bump (same install step, same workflow, before tests run).

Checklist

• Tests updated
• Docs updated

Screenshots

N/A — dependency CVE bump plus type-only compile fixes.

Staging smoke (human, after merge to dev)

• Hit the staging homepage, login, a notes page, and dashboard
• Confirm the app still boots and auth still works