fix(web): migrate to React Router 8

CONTRIBUTING.md

@@ -37,7 +37,7 @@ Read:
 ## Prerequisites
 
 - Rust `1.90.0` with `rustfmt` and `clippy`;
-- Node.js `22` and npm for building the embedded frontend assets;
+- Node.js `22.22.0` or newer and npm for building the embedded frontend assets;
 - Codex `0.144.0` for adapter and App Server compatibility work.
 
 ```text

README.md

@@ -145,8 +145,8 @@ Requirements:
 
 - Rust `1.90.0` with `rustfmt` and `clippy`;
 - Codex `0.144.0` for the currently validated adapter;
-- Node.js `22` and npm for building the embedded frontend assets (Node is not
-  needed at runtime).
+- Node.js `22.22.0` or newer and npm for building the embedded frontend assets
+  (Node is not needed at runtime).
 
 ```text
 cd crates/needle-app/web

SECURITY.md

@@ -29,18 +29,10 @@ other sensitive information out of the public issue.
 For ordinary bugs, regressions, and feature requests, use the normal public
 issue or pull-request process instead of this security-reporting route.
 
-## Known dependency advisories
-
-The installed `react-router-dom` version is `7.18.1`, which falls within the
-affected range (`>=7.12.0, <8.3.0`) of
-[GHSA-qwww-vcr4-c8h2](https://github.com/advisories/GHSA-qwww-vcr4-c8h2).
-Upstream describes this advisory as affecting unstable React Server Component
-(RSC) APIs. Needle's current Vite client-side SPA uses `BrowserRouter` and
-`createRoot` and does not enable those RSC APIs; this bounded non-exposure does
-not mean the dependency is generally safe.
-
-Upstream identifies `8.3.0` as the first patched release, but that release is
-not available from npm as of 2026-08-03. This is a temporary, scoped exception,
-not evidence of a completed security audit. Do not enable the affected RSC APIs;
-monitor for a published patched release, then upgrade and rerun `npm audit`,
-tests, lint, and build. Remove this exception once that validation succeeds.
+## Resolved dependency advisories
+
+[GHSA-qwww-vcr4-c8h2](https://github.com/advisories/GHSA-qwww-vcr4-c8h2)
+was remediated by migrating the Vite client-side SPA from the removed
+`react-router-dom` package to `react-router` `8.3.0`. Needle does not enable the
+affected unstable React Server Component (RSC) APIs. This remediation does not
+constitute a completed third-party security audit.

crates/needle-app/web/package.json

@@ -23,9 +23,9 @@
     "clsx": "^2.1.1",
     "lucide-react": "^1.27.0",
     "radix-ui": "^1.6.7",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
-    "react-router-dom": "7.18.1",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
+    "react-router": "8.3.0",
     "recharts": "^3.10.1",
     "tailwind-merge": "^3.6.0",
     "tailwindcss": "^4",

crates/needle-app/web/src/App.tsx

@@ -1,5 +1,5 @@
 import { lazy, Suspense } from "react"
-import { BrowserRouter, Navigate, Route, Routes } from "react-router-dom"
+import { BrowserRouter, Navigate, Route, Routes } from "react-router"
 
 import { AppShell } from "@/components/app-shell"
 import { Skeleton } from "@/components/ui/skeleton"

crates/needle-app/web/src/components/app-shell.tsx

@@ -20,7 +20,7 @@ import {
   ShieldCheck,
   SlidersHorizontal,
 } from "lucide-react"
-import { NavLink, useLocation } from "react-router-dom"
+import { NavLink, useLocation } from "react-router"
 
 import { useApprovalEvents, useControlPlane } from "@/api"
 import {

crates/needle-app/web/src/pages/changes-page.tsx

@@ -1,6 +1,6 @@
 import { type ReactNode, useState } from "react"
 import { ArrowLeft, FilePenLine } from "lucide-react"
-import { Link, useParams } from "react-router-dom"
+import { Link, useParams } from "react-router"
 
 import {
   type ChangeAttempt,

crates/needle-app/web/src/pages/overview-page.tsx

@@ -8,7 +8,7 @@ import {
   Server,
 } from "lucide-react"
 import type { ReactNode } from "react"
-import { Link } from "react-router-dom"
+import { Link } from "react-router"
 
 import { useControlPlane } from "@/api"
 import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty"

crates/needle-app/web/src/pages/resource-page.tsx

@@ -10,7 +10,7 @@ import {
   SlidersHorizontal,
 } from "lucide-react"
 import { useState } from "react"
-import { useParams } from "react-router-dom"
+import { useParams } from "react-router"
 
 import {
   type ControlPlane,

docs/DEVELOPER_SETUP.md

@@ -7,8 +7,8 @@ run. It is a development workflow, not a supported installation path.
 
 - Rust `1.90.0` with `rustfmt` and `clippy`;
 - Codex `0.144.0` for the currently validated App Server adapter;
-- Node.js `22` and npm for building the embedded frontend assets. Node.js is
-  not needed at runtime.
+- Node.js `22.22.0` or newer and npm for building the embedded frontend assets.
+  Node.js is not needed at runtime.
 
 ```text
 rustup toolchain install 1.90.0 --component rustfmt --component clippy

docs/RUNTIME_AND_WEB_CONTROL_PLANE.md

@@ -68,8 +68,9 @@ This is a local development control plane, not a remotely hosted service.
 - Settings.
 
 The frontend uses React, TypeScript, Vite, React Router, TanStack Query,
-Tailwind, shadcn/ui patterns, and Recharts. Node.js 22 and npm are required to
-build the embedded assets; the running Rust binary does not invoke Node.js.
+Tailwind, shadcn/ui patterns, and Recharts. Node.js 22.22.0 or newer and npm are
+required to build the embedded assets; the running Rust binary does not invoke
+Node.js.
 
 ## API groups