chore(deps): update dependency react-router to v7.5.2 [security] (main) (#7271)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [react-router](https://redirect.github.com/remix-run/react-router)
([source](https://redirect.github.com/remix-run/react-router/tree/HEAD/packages/react-router))
| [`7.5.1` ->
`7.5.2`](https://renovatebot.com/diffs/npm/react-router/7.5.1/7.5.2) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/react-router/7.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/react-router/7.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/react-router/7.5.1/7.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-router/7.5.1/7.5.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-43864](https://redirect.github.com/remix-run/react-router/security/advisories/GHSA-f46r-rw29-r322)

## Summary
After some research, it turns out that it is possible to force an
application to switch to SPA mode by adding a header to the request. If
the application uses SSR and is forced to switch to SPA, this causes an
error that completely corrupts the page. If a cache system is in place,
this allows the response containing the error to be cached, resulting in
a cache poisoning that strongly impacts the availability of the
application.

## Details
The vulnerable header is `X-React-Router-SPA-Mode`; adding it to a
request sent to a page/endpoint using a loader throws an error. Here is
[the vulnerable
code](https://redirect.github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407)
:

<img width="672" alt="Capture d’écran 2025-04-07 à 08 28 20"
src="https://github.com/user-attachments/assets/0a0e9c41-70fd-4dba-9061-892dd6797291"
/>

To use the header, React-router must be used in Framework mode, and for
the attack to be possible the target page must use a loader.

## Steps to reproduce 
Versions used for our PoC: 
- "@&#8203;react-router/node": "^7.5.0",
- "@&#8203;react-router/serve": "^7.5.0",
- "react": "^19.0.0"
- "react-dom": "^19.0.0"
- "react-router": "^7.5.0"

1. Install React-Router with its default configuration in Framework mode
(https://reactrouter.com/start/framework/installation)
2. Add a simple page using a loader (example: `routes/ssr`)


![image](https://redirect.github.com/user-attachments/assets/d7d04e86-c549-4f4a-9200-2d1b6ac96aad)

3. Send a request to the endpoint using the loader (`/ssr` in our case)
adding the following header:
```
X-React-Router-SPA-Mode: yes
```

Notice the difference between a request with and without the header;

**Normal request**
![Capture d’écran 2025-04-07 à 08 36
27](https://redirect.github.com/user-attachments/assets/da372b70-7c68-41c1-aac1-e5be94f22526)

**With the header**
![Capture d’écran 2025-04-07 à 08 37
01](https://redirect.github.com/user-attachments/assets/98101720-cb5b-44e9-bff5-463c0b4dab2a)

![image](https://redirect.github.com/user-attachments/assets/c16a101e-688c-4757-9e05-61308ed8a2de)

## Impact
If a system cache is in place, it is possible to poison the response by
completely altering its content (*by an error message*), strongly
impacting its availability, making the latter impractical via a
cache-poisoning attack.

## Credits
- Rachid Allam (zhero;)
- Yasser Allam (inzo_)

####
[CVE-2025-43865](https://redirect.github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j)

## Summary
After some research, it turns out that it's possible to modify
pre-rendered data by adding a header to the request. This allows to
completely spoof its contents and modify all the values ​​of the data
object passed to the HTML. Latest versions are impacted.

## Details
The vulnerable header is `X-React-Router-Prerender-Data`, a specific
JSON object must be passed to it in order for the spoofing to be
successful as we will see shortly. Here is [the vulnerable
code](https://redirect.github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87)
:

<img width="776" alt="Capture d’écran 2025-04-07 à 05 36 58"
src="https://github.com/user-attachments/assets/c95b0b33-15ce-4d30-9f5e-b10525dd6ab4"
/>

To use the header, React-router must be used in Framework mode, and for
the attack to be possible the target page must use a loader.

## Steps to reproduce 
Versions used for our PoC: 
- "@&#8203;react-router/node": "^7.5.0",
- "@&#8203;react-router/serve": "^7.5.0",
- "react": "^19.0.0"
- "react-dom": "^19.0.0"
- "react-router": "^7.5.0"

1. Install React-Router with its default configuration in Framework mode
(https://reactrouter.com/start/framework/installation)
2. Add a simple page using a loader (example: `routes/ssr`)
3. Access your page (*which uses the loader*) by suffixing it with
`.data`. In our case the page is called `/ssr`:


![image](https://redirect.github.com/user-attachments/assets/d7d04e86-c549-4f4a-9200-2d1b6ac96aad)

We access it by adding the suffix `.data` and retrieve the data object,
needed for the header:


![image](https://redirect.github.com/user-attachments/assets/ea0ca23e-6ba5-49c1-980d-1b04a05acf56)

4. Send your request by adding the `X-React-Router-Prerender-Data`
header with the previously retrieved object as its value. You can change
any value of your `data` object (do not touch the other values, the
latter being necessary for the object to be processed correctly and not
throw an error):

![Capture d’écran 2025-04-07 à 05 56
10](https://redirect.github.com/user-attachments/assets/42ca7c9e-5cd3-4eff-9711-1e78755c9046)

As you can see, all values ​​have been changed/overwritten by the values
​​provided via the header.

## Impact
The impact is significant, if a cache system is in place, it is possible
to poison a response in which all of the data transmitted via a loader
would be altered by an attacker allowing him to take control of the
content of the page and modify it as he wishes via a cache-poisoning
attack. This can lead to several types of attacks including potential
stored XSS depending on the context in which the data is injected and/or
how the data is used on the client-side.

## Credits
- Rachid Allam (zhero;)
- Yasser Allam (inzo_)

---

### Release Notes

<details>
<summary>remix-run/react-router (react-router)</summary>

###
[`v7.5.2`](https://redirect.github.com/remix-run/react-router/blob/HEAD/packages/react-router/CHANGELOG.md#752)

[Compare
Source](https://redirect.github.com/remix-run/react-router/compare/[email protected]@7.5.2)

##### Patch Changes

- Update Single Fetch to also handle the 204 redirects used in `?_data`
requests in Remix v2
([#&#8203;13364](https://redirect.github.com/remix-run/react-router/pull/13364))

- This allows applications to return a redirect on `.data` requests from
outside the scope of React Router (i.e., an `express`/`hono` middleware)
- ⚠️ Please note that doing so relies on implementation details that are
subject to change without a SemVer major release
- This is primarily done to ease upgrading to Single Fetch for existing
Remix v2 applications, but the recommended way to handle this is
redirecting from a route middleware

- Adjust approach for Prerendering/SPA Mode via headers
([#&#8203;13453](https://redirect.github.com/remix-run/react-router/pull/13453))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/SAP/ui5-webcomponents-react).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

examples/vite-ts/package-lock.json

@@ -20,7 +20,7 @@
     "@ui5/webcomponents-react": "2.9.2",
     "react": "19.1.0",
     "react-dom": "19.1.0",
-    "react-router": "7.5.1"
+    "react-router": "7.5.2"
   },
   "devDependencies": {
     "@types/react": "19.1.2",