Supported classic Hydrogen dependency path for React Router GHSA-chx6-hx7r-mcp5

[williamjcgarden]

We are preparing a classic Hydrogen application for release and need guidance on a supported dependency combination for the published React Router advisory GHSA-chx6-hx7r-mcp5 (inefficient route matching / denial of service).

Versions and compatibility constraint

• Our isolated candidate uses @shopify/hydrogen@2026.4.4 and react-router@7.16.0.
• Rechecked October 16, 2026: @shopify/hydrogen@2026.4.7 declares both react-router and @react-router/dev peers as ~7.16.0.
• The GitHub advisory currently lists React Router >=7.0.0, <7.18.0 as affected and 7.18.0 as the first patched version. Our reviewed update target was 7.18.4; neither is permitted by that Hydrogen peer range.
• We have not forced peers, accepted an unsupported override, or deployed this candidate.

Questions

1. Is there a supported classic-Hydrogen release/backport that permits a patched Router version?
2. If not, is migration to Hydrogen 2026.10 the supported route, and which secure dependency combination should be used? The migration guide's Router 7.15.1 example does not establish remediation for this advisory.

Shopify Support directed us to this repository after being unable to confirm a patched combination or backport date. Support explicitly said no internal engineering escalation was filed; we do not have a verified case reference.

Posting in Help, following this repository's issue-template guidance for compatibility questions. This concerns an already published advisory, not a new vulnerability disclosure. No exploit, customer/store data or private source is included. We can provide a minimal sanitized reproduction if needed.

[FelixFangX]

I checked npm and the repo for this today. Short version: there's no classic release that allows a patched React Router yet, and 2026.10 doesn't constrain React Router at all.

• Classic (2026.4.x): @shopify/hydrogen@2026.4.7 is the newest on that line and still declares react-router / @react-router/dev as ~7.16.0 peers. The 2026-04 branch has the same pins, so nothing is waiting there either. Installing it with react-router@7.18.4 fails with ERESOLVE on the @react-router/dev@~7.16.0 peer. There are open dependabot PRs for the bump (e.g. Chore(deps-dev): Bump react-router from 7.16.0 to 7.18.2 in /packages/remix-oxygen #3933 for remix-oxygen), and a community PR (fix(deps): bump react-router to patch 5 disclosed advisories #4011) was closed with "we already have dependabot PRs open for these", but none of it targets a 2026.4.x release so far. A maintainer would have to confirm whether a 2026.4.8 is planned.
• 2026.10: @shopify/hydrogen@2026.10.1 (current latest) only has optional peers on react, vite and vue. There's no React Router peer, so your app owns that version. A fresh install of @shopify/hydrogen@2026.10.1 with react-router@7.18.4 and @react-router/dev@7.18.4 resolves without peer warnings and npm audit comes back clean. One thing to watch: the templates/react-router starter on main still pins 7.15.1 (dependabot chore(deps): bump react-router from 7.15.1 to 7.18.2 in /templates/react-router #4164 bumps it to 7.18.2), so if you scaffold from the template, bump both packages to >=7.18.0 yourself.

So yes: unless Shopify ships a 2026.4.x bump, the migration is the supported way to get onto a patched Router. I only tested install and peer resolution, not a full storefront build on 7.18.4, so that part still needs your usual build/test run.