Fusion Framework — React Router Hooks, Security Patches & Dependency Maintenance

[odinr]

Fusion Framework — React Router Hooks, Security Patches & Dependency Maintenance

This release rounds out the React Router migration story with two more hook re-exports, clears 17 open security advisories, and carries a batch of routine dependency maintenance across the CLI, lint tooling, telemetry, and vite-plugins packages.

---

🧭 useBlocker and useBeforeUnload in @equinor/fusion-framework-react-router

Teams migrating off react-router-dom no longer need a direct dependency on react-router just for these two hooks — they're now re-exported from @equinor/fusion-framework-react-router@2.4.0, alongside the existing useNavigate, useLocation, and friends.

Thanks to @edmondbaloku for the request (equinor/fusion#888).

---

🔐 Security — 17 advisories cleared

17 of 19 open Dependabot alerts on main patched, either via pnpm.overrides (transitive dependencies) or direct package.json bumps (real dependencies), no code changes required:

Severity	Package	Fix
HIGH ×2	brace-expansion	Overrides → 2.1.2 / 5.0.8
HIGH	react-router	Direct bump ^7.13.1 → ^7.18.0 — DoS via inefficient route matching, open-redirect/protocol-validation
HIGH	postcss	Override → 8.5.18
HIGH	form-data	Override → 4.0.6
HIGH	esbuild	Override → 0.28.1 (dev-portal), plus a real direct bump in @equinor/fusion-imports (runtime dependency, not just build tooling)
MODERATE	qs	Override → 6.15.2
MODERATE	valibot	Override → 1.4.2
MODERATE ×2	fast-uri	Override → 3.1.4
LOW	dompurify	Override → 3.4.12
LOW	@babel/core	Override → 7.29.6

The overrides block was also cleaned up while we were in there — 5 dead entries removed (tar, axios, hono, cross-spawn, @isaacs/brace-expansion) that had zero resolved presence anywhere in the lockfile, plus consistent indentation.

The 2 remaining advisories require react-router@8.3.0, a major version bump the team has previously deferred pending a planned v8 migration (#5058, #5032, #5031, #5175) — left open intentionally.

---

🛠️ CLI & Tooling

• chalk → 6.0.0 across the CLI and several CLI plugins — raises its own Node.js requirement to >=22, already satisfied by this repo's >=24 engines requirement. No API changes affecting usage here.
• execa → 10.0.0 in the CLI — subprocesses returned by execa() are no longer ChildProcess-augmented; Node.js-specific methods like .unref() now go through subprocess.nodeChildProcess. Handled internally, no consumer-facing change.
• vscode-languageserver → 10.1.0 (fusion-framework-lint-lsp) — the package dropped the /node.js export subpath in favor of /node; import updated accordingly.
• vscode-languageclient → 10.1.0 (fusion-ts-lint-vscode) — traceOutputChannel now requires a LogOutputChannel, created via window.createOutputChannel(name, { log: true }).
• jsdom → 30.0.1 (module-navigation), matching the Node.js versions supported by CI.
• @opentelemetry/* → 0.221.0/2.10.0 (module-analytics) — createOtlpNetworkExportDelegate now requires an ExporterMetrics instance; FusionOTLPLogExporter updated to construct and pass one.
• dotenv-expand → 1000.0.0 (fusion-load-env) — a version-number jump by the maintainer, not a semantic major; adds command substitution and encrypted .env value support.
• typescript → 7.0.2 and vite → 8.1.5 in the markdown and routes-dsl vite-plugins, matching the rest of the vite-plugins packages.

---

🎨 UI

@equinor/fusion-framework-react-components-bookmark now shows accessible loading feedback for the app name while the edit bookmark modal resolves its app manifest.

---

📦 Released Packages

Package	Version	Type
@equinor/fusion-framework-react-router	2.4.0	minor
@equinor/fusion-framework-cli	15.2.2	patch
@equinor/fusion-imports	2.0.2	patch
@equinor/fusion-framework-dev-server	2.0.16	patch
@equinor/fusion-framework-dev-portal	8.0.2	patch
@equinor/fusion-framework-cli-plugin-ai-base	4.0.7	patch
@equinor/fusion-framework-cli-plugin-ai-chat	3.0.7	patch
@equinor/fusion-framework-cli-plugin-ai-index	3.0.8	patch
@equinor/fusion-framework-cli-plugin-copilot	2.0.4	patch
@equinor/fusion-lint	0.3.1	patch
@equinor/fusion-framework-lint-lsp	0.2.2	patch
fusion-ts-lint-vscode	0.2.3	patch
@equinor/fusion-framework-module-analytics	3.0.3	patch
@equinor/fusion-framework-module-navigation	7.0.6	patch
@equinor/fusion-framework-react-app	12.0.4	patch
@equinor/fusion-framework-react-components-bookmark	2.0.3	patch
@equinor/fusion-load-env	2.0.3	patch
@equinor/fusion-log	2.0.2	patch
@equinor/fusion-framework-vite-plugin-markdown	1.1.2	patch
@equinor/fusion-framework-vite-plugin-routes-dsl	1.0.2	patch
poc-portal	1.1.91	patch (dep cascade)
portal	0.1.76	patch (dep cascade)
portal-analytics	0.4.44	patch (dep cascade)

---

🔗 Key PRs

• React Router hooks (useBlocker, useBeforeUnload) — #5181
• Security patches (overrides + direct bumps) — #5180
• Release PR — #5166

---

🤖 Beep Bopp — Release notes assembled by Fusion Assistant. The router hooks migration marches on, one re-export at a time.