Repository navigation
SUPPLY-001B — Patch React Router 6 and resolve future flags #192
Description
Outcome
Patch the existing React Router 6 line from the locked 6.30.0 / @remix-run/router 1.23.0 graph to the current compatible v6 release, opt into the two documented v7 behavior flags deliberately, and prove the club's routes and capability callbacks still work without a route redesign.
Dependency and exact claim
Dependency CI-001A/#103 is complete.
CLAIMED by /root at 2026-07-13T23:10:46Z on codex/issue-192-react-router-6-patch, based on exact main efe82e115a5edfbea58a2c9f70f9c2b6b734771b.
Owned paths only:
package.jsonpackage-lock.jsonsrc/App.jsxsrc/App.test.jsxSECURITY.mdOPERATIONS_RUNBOOK.mdGITHUB_ISSUES.mdGITHUB_ISSUE_SLICES.md
Excluded: route inventory/design changes, page components, public SPA fallback/runtime, workflows, lint baseline/checker, Firebase/Functions/Rules, Stripe, provider/branch/deploy settings, and every other issue.
Security invariant
- Stay on React Router major 6.
- The lock must contain one coherent reviewed router graph.
- Same-origin SPA callback query/fragment preservation and unsafe-target rejection from SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99/CI-001B1A — Run SPA callback safety tests in hosted CI #126 must remain unchanged.
- Enabling future flags may change only the documented router compatibility semantics; it must not add, remove, or rename club routes.
- No forced audit upgrade and no unrelated dependency churn.
Allowed transition
react-router-dom/transitive router packages: locked 6.30.0/1.23.0 → exact compatible v6 patch graph at 6.30.4/1.23.3, after lockfile, advisory, navigation, callback, test, and build review.
Failure cases
Stop if the install crosses major 6, changes unrelated retained package versions, weakens callback safety, introduces new test warnings/failures, changes route behavior, increases production advisories, or requires provider/production access.
Acceptance
- Update the direct dependency and only its required lockfile graph to React Router DOM 6.30.4.
- Prove
react-routeris 6.30.4 and@remix-run/routeris at least the advisory-patched 1.23.3. - Opt
BrowserRouterintov7_startTransitionandv7_relativeSplatPath; add a focused regression test that fails while the warnings remain. - Pass the full frontend Jest suite, standalone SPA callback suite, non-mutating lint, build, Functions tests, Rules tests, and commerce emulator suite.
- Record before/after production audit counts and review the exact lockfile delta.
- Update the narrow engineering status truth and obtain independent security/test review.
- Merge only after exact-head hosted checks pass; record post-merge evidence separately.
Migration/rollback
No data migration and no route redesign. Rollback is the prior package/lock/App/doc revision if the reviewed tests expose a compatibility regression; do not partially roll back only one package in the router graph.
Officer impact: None — public routes and officer procedures are intended to remain unchanged.
Officer documentation: None — no officer task changes.
Deployment evidence: Source/tests/merge only unless an affected website release is separately run and verified. No Firebase, Stripe, provider, branch-setting, or production behavior claim.
Activity
daliu commentedon Jul 13, 2026
SCOPE AMENDMENT / CLAIM EXTENSION — 2026-07-13T23:13:49Z
Read-only inspection found that the existing MemoryRouter harnesses also emit the two React Router future-flag warnings during the full suite. Before editing them, #192 adds exact ownership of:
These are test-only compatibility harnesses. They will receive the same v7_startTransition and v7_relativeSplatPath flags as the production BrowserRouter; no application route, login return behavior, account behavior, or provider boundary changes.
OPERATIONS_RUNBOOK.md remains unchanged and is released from this claim because the documented audit command/policy does not change.
daliu commentedon Jul 13, 2026
EXTRACTION FINISHED / IN REVIEW — 2026-07-13T23:22:12Z
PR #193 carries exact source 312be3b from base efe82e1.
The nine-file diff stays within the original claim plus the timestamped test-harness amendment. Node 20 audit is 22→19 total and 8→5 high, with no remaining router entry. Local evidence: focused 45/45, full frontend 135/135 without Router warnings, SPA 10/10, workflow tests 42/42, Functions 990 pass/32 skip, Rules 317/317, commerce emulator 31/31, lint baseline, clean install/tree, build, links, and diff check all pass.
Independent security and documentation reviews approved. Merge awaits exact-head hosted CI and the final independent test review. No website, Firebase, Stripe/provider, branch-setting, or production deployment has occurred.
daliu commentedon Jul 13, 2026
COMPLETE / CLAIM RELEASED — 2026-07-13T23:30:08Z
PR #193 was independently approved and squash-merged as exact main
aafd15c04fbcd09341092a78f23d513b09cca5d2. Exact-head CI run 29292832416 and post-merge CI run 29292999755 passed all five hosted jobs. The React Router graph is exactlyreact-router-dom/react-router6.30.4 plus@remix-run/router1.23.3; the root production audit moved 22→19 total and 8→5 high with no remaining router advisory. Local focused 45/45, full frontend 135/135, SPA 10/10, Functions, Rules, commerce-emulator, lint-baseline, clean-install/tree, artifact-workflow, build, links, and diff checks passed.Protected production release run 29293185980 was then requested for this exact current-main commit under the fixed
profile-recoveryplan. Current-main/green-CI validation passed, but the release failed closed before checkout/build because the required public App Check site key variable was absent. Firebase deployment and Pages publication were skipped. No website, Firebase, Stripe/provider, production-data, or live-behavior change is claimed from that run.Officer impact: None — public route names and officer tasks did not change.
Officer documentation: None — no officer procedure changed.
Deployment evidence: source, tests, review, merge, and exact post-merge CI proven; Netlify PR preview was ready. Production website publication,
runmprc.comverification, Firebase deployment, and provider configuration were not performed. The release blocker belongs to the protected deployment/external-configuration work tracked under #105/#136.The nine-path claim plus the timestamped two-test harness amendment is released. The remote topic branch was deleted after merge.