Bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /jbrowse directory: bootstrap.

Removes bootstrap

Updates immutable from 3.8.3 to 3.8.4

Release notes

Sourced from immutable's releases.

v3.8.4

What's Changed

• Port DoS patches for CVE-2026-59879 and CVE-2026-59880 onto branch 3.x by @​Zoe7 in immutable-js/immutable-js#2250

New Contributors

• @​Zoe7 made their first contribution in immutable-js/immutable-js#2250

Full Changelog: immutable-js/immutable-js@v3.8.3...v3.8.4

Commits

• 4c57f48 3.8.4
• 6796775 Merge branch 'Zoe7-port-ghsa-list-and-hash-collision' into 3.x
• 0fe3f77 Port DoS patches for CVE-2026-59879 and CVE-2026-59880 onto branch 3.x
• 9ec138f wrong npm tag
• cc1d403 update package
• 6dc6c6f try to build with docker
• 2d65e47 update release script
• See full diff in compare view

Updates react-router from 6.30.6 to 7.18.3

Release notes

Sourced from react-router's releases.

v7.18.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7183

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

v7.16.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160

v7.15.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151

v7.15.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150

v7.14.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142

v7.14.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141

v7.14.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7140

v7.13.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7132

v7.13.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7131

v7.13.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7130

v7.12.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7120

v7.11.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7110

v7.10.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7101

... (truncated)

Changelog

Sourced from react-router's changelog.

v7.18.3

Patch Changes

• Improve route matching performance for long paths (#15423)
• Improve validation of action request origins (#15420)
• Add additional URL validation on client side navigations/redirects (#15446)

v7.18.2

Patch Changes

• Harden RSC CSRF codepaths. (#15353)

v7.18.1

Patch Changes

• No changes

v7.18.0

Patch Changes

• Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)
• Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)
• Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)
• Precompute route branch matchers to avoid recompiling route path regexes during matching (#15186)
• Use the constructed request URL host when validating action request origins. (#15185)
• Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)
• Validate protocols in RSC render redirects (#15177)
• Consolidate url normalization logic and better handle mixed slashes (#15176)

v7.17.0

Minor Changes

• Ship a subset of the official documentation inside the react-router package (#15121)
  • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
  • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Minor Changes

• Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#15098)

Patch Changes

• Disable manifest path when lazy route dicovery is disabled (#15068)

... (truncated)

Commits

• 23166df Release v7.18.3 (#15424)
• 38af67f Validate client-side navigation targets (#15446)
• df78a29 Revert "fix: normalize control characters in relative URLs (#15422)" (#15441)
• d1a4b1d fix: normalize control characters in relative URLs (#15422)
• e7c2d94 Revert "fix: normalize RSC server redirects (#15421)" (#15434)
• e4b70d6 fix: validate schemeful action origins (#15420)
• b137cab fix: normalize RSC server redirects (#15421)
• 6cc6f7a fix: improve matching perf (#15423)
• 69a653e Release v7.18.2 (#15354)
• 8ebd5df Harden RSC CSRF codepaths (backport of #15311) (#15353)
• Additional commits viewable in compare view

[bbimber]

@dependabot rebase