Bump react-router and react-router-dom in /samples/demo/client

[dependabot]

Bumps react-router to 7.18.2 and updates ancestor dependency react-router-dom. These dependencies need to be updated together.

Updates react-router from 7.15.1 to 7.18.2

Release notes

Sourced from react-router's releases.

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

v7.16.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160

Changelog

Sourced from react-router's changelog.

v7.18.2

Patch Changes

• Harden RSC CSRF codepaths. (#15353)

v7.18.1

Patch Changes

• No changes

v7.18.0

Patch Changes

• Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)
• Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)
• Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)
• Precompute route branch matchers to avoid recompiling route path regexes during matching (#15186)
• Use the constructed request URL host when validating action request origins. (#15185)
• Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)
• Validate protocols in RSC render redirects (#15177)
• Consolidate url normalization logic and better handle mixed slashes (#15176)

v7.17.0

Minor Changes

• Ship a subset of the official documentation inside the react-router package (#15121)
  • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
  • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Minor Changes

• Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#15098)

Patch Changes

• Disable manifest path when lazy route dicovery is disabled (#15068)

• Fix browser URL creation to use the configured history window instead of the global window. (#15066)

  • Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.

• Fix useNavigation() return type to preserve discriminated union across navigation states (#15095)

• Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#15082)

Commits

• 69a653e Release v7.18.2 (#15354)
• 8ebd5df Harden RSC CSRF codepaths (backport of #15311) (#15353)
• afdf85d Release v7.18.1 (#15253)
• 6fb1e79 Release v7.18.0 (#15187)
• 09e6020 Optimize route matching internals (#15186)
• 5b57f5f Request Host derivation + CSRF check simplifications (#15185)
• ce596e8 Validate RSC redirect protocols (#15177)
• 1cebd2a chore: format
• 9d22943 Use turbo stream for framework hydration errors (#15175)
• bf63729 Consolidate url normalization logic (#15176)
• Additional commits viewable in compare view

Updates react-router-dom from 7.15.1 to 7.18.2

Changelog

Sourced from react-router-dom's changelog.

v7.18.2

Patch Changes

• Updated dependencies:
  • react-router@7.18.2

v7.18.1

Patch Changes

• Fix incorrect package.json main field for CommonJS builds (#15238)
• Updated dependencies:
  • react-router@7.18.1

v7.18.0

Patch Changes

• Updated dependencies:
  • react-router@7.18.0

v7.17.0

Patch Changes

• Updated dependencies:
  • react-router@7.17.0

v7.16.0

Patch Changes

• Remove stale/invalid unpkg field from package.json. This was removed from other packages with the release of v7 but missed in the react-router-dom re-export package (#15075)
• Updated dependencies:
  • react-router@7.16.0

Commits

• 69a653e Release v7.18.2 (#15354)
• afdf85d Release v7.18.1 (#15253)
• 2ecaa1d Fix react-router-dom main entry metadata (#15238)
• 6fb1e79 Release v7.18.0 (#15187)
• 195a0d0 Release v7.17.0 (#15145)
• 8984d23 Release v7.16.0 (#15105)
• 3ed77af chore: format
• e96962b fix: remove stale unpkg field from react-router-dom (#15075)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/react-router	7.18.2	🟢 4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Code-Review 🟢 5 Found 14/28 approved changesets -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/react-router-dom	7.18.2	🟢 4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Code-Review 🟢 5 Found 14/28 approved changesets -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• samples/demo/client/package-lock.json

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.