fix(deps): update react-router security releases

[ScriptedAlchemy]

Summary

• Updates repo react-router/react-router-dom consumers on maintained v6/v7 lines to patched releases.
• Adds a pnpm override for @remix-run/router 1.23.2 so nested v6 router resolutions use the patched XSS/open-redirect fix.
• Refreshes pnpm-lock.yaml for the updated router dependency graph.

Closes #4474

Validation

• corepack pnpm install --lockfile-only --ignore-scripts
• corepack pnpm install --frozen-lockfile --lockfile-only --ignore-scripts
• corepack pnpm audit --prod --json confirmed no remaining react-router/react-router-dom/@remix-run/router advisories were reported.

Skipped checks

• Full package build/test/lint were not run because this PR is a dependency/security remediation spanning demo apps and package dev fixtures; frozen lockfile validation and audit verification were run instead.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1f5a7a0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 46 packages

Name	Type
@module-federation/bridge-react	Patch
@module-federation/treeshake-frontend	Patch
@module-federation/modern-js-v3	Patch
@module-federation/modern-js	Patch
remote5	Patch
remote6	Patch
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
@module-federation/runtime	Patch
@module-federation/enhanced	Patch
@module-federation/rspack	Patch
@module-federation/webpack-bundler-runtime	Patch
@module-federation/sdk	Patch
@module-federation/runtime-tools	Patch
@module-federation/managers	Patch
@module-federation/manifest	Patch
@module-federation/dts-plugin	Patch
@module-federation/third-party-dts-extractor	Patch
@module-federation/devtools	Patch
@module-federation/bridge-vue3	Patch
@module-federation/bridge-shared	Patch
@module-federation/bridge-react-webpack-plugin	Patch
@module-federation/retry-plugin	Patch
@module-federation/rsbuild-plugin	Patch
@module-federation/error-codes	Patch
@module-federation/inject-external-runtime-core-plugin	Patch
@module-federation/runtime-core	Patch
create-module-federation	Patch
@module-federation/cli	Patch
@module-federation/rspress-plugin	Patch
@module-federation/treeshake-server	Patch
@module-federation/metro	Patch
@module-federation/metro-plugin-rnef	Patch
@module-federation/metro-plugin-rock	Patch
@module-federation/metro-plugin-rnc-cli	Patch
@module-federation/esbuild	Patch
@module-federation/nextjs-mf	Patch
@module-federation/node	Patch
@module-federation/observability-plugin	Patch
@module-federation/storybook-addon	Patch
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
@module-federation/utilities	Patch
website-new	Patch
node-dynamic-remote-new-version	Patch
node-dynamic-remote	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	1f5a7a0
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a166f0aeb1d4e000842d87a
😎 Deploy Preview	https://deploy-preview-4763--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@288bde4

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@288bde4

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@288bde4

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@288bde4

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@288bde4

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@288bde4

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@288bde4

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@288bde4

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@288bde4

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@288bde4

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@288bde4

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@288bde4

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@288bde4

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@288bde4

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@288bde4

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@288bde4

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@288bde4

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@288bde4

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@288bde4

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@288bde4

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@288bde4

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@288bde4

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@288bde4

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@288bde4

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@288bde4

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@288bde4

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@288bde4

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@288bde4

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@288bde4

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@288bde4

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@288bde4

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@288bde4

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@288bde4

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@288bde4

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@288bde4

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@288bde4

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@288bde4

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@288bde4

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@288bde4

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@288bde4

commit: 288bde4

[github-actions]

Bundle Size Report

12 package(s) changed, 29 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/cli	26.3 kB	no change	786 B	no change
@module-federation/core	39.1 kB	no change	173 B	no change
@module-federation/devtools	664.0 kB	no change	4.0 kB	no change
@module-federation/enhanced	807.9 kB	no change	672 B	no change
@module-federation/managers	69.8 kB	no change	334 B	no change
@module-federation/manifest	136.1 kB	no change	182 B	no change
@module-federation/metro-plugin-rnc-cli	0 B	no change	314 B	no change
@module-federation/node	193.4 kB	no change	217 B	no change
@module-federation/storybook-addon	77.9 kB	no change	100 B	no change
@module-federation/treeshake-frontend	629.3 kB	+4.5 kB (+0.7%)	0 B	no change
@module-federation/treeshake-server	812.0 kB	+4.5 kB (+0.6%)	8.0 kB	no change
@module-federation/utilities	110.6 kB	no change	328 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	-31 B (-1.3%)	2.3 kB	-31 B (-1.3%)
@module-federation/core	1.1 kB	-32 B (-2.9%)	1.0 kB	-31 B (-2.9%)
@module-federation/devtools	30.2 kB	-27 B (-0.1%)	30.2 kB	-27 B (-0.1%)
@module-federation/enhanced	2.6 kB	-45 B (-1.6%)	2.6 kB	-45 B (-1.6%)
@module-federation/managers	2.4 kB	-27 B (-1.1%)	2.4 kB	-27 B (-1.1%)
@module-federation/manifest	6.1 kB	-41 B (-0.7%)	6.1 kB	-41 B (-0.7%)
@module-federation/metro-plugin-rnc-cli	411 B	-26 B (-5.9%)	411 B	-26 B (-5.9%)
@module-federation/node	9.2 kB	-29 B (-0.3%)	9.2 kB	-29 B (-0.3%)
@module-federation/storybook-addon	1.9 kB	-24 B (-1.2%)	1.7 kB	-24 B (-1.3%)
@module-federation/treeshake-frontend	n/a	n/a	n/a	n/a
@module-federation/treeshake-server	5.7 kB	no change	5.7 kB	no change
@module-federation/utilities	2.6 kB	-32 B (-1.2%)	2.6 kB	-32 B (-1.2%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	21.4 kB	-19 B (-0.1%)	22.5 kB	-11 B (-0.0%)	+1.1 kB	+8 B

Total dist (raw): 6.79 MB (+9.0 kB (+0.1%))
Total ESM gzip: 76.6 kB (no change)
Total web bundle (gzip): 205.4 kB (-314 B (-0.1%))
Total node bundle (gzip): 205.9 kB (-313 B (-0.1%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.