fix(deps): bump react-router to 6.30.6 for CVE backports

[kim-tsao]

Summary

• Bump react-router in packages/app from 6.30.4 to 6.30.6 (latest on the v6 line) and refresh yarn.lock.
• react-router-dom was already on 6.30.6; both packages now resolve to a single v6 copy.
• Supersedes Dependabot #5431, which proposed jumping to react-router@7.18.2.

Why not v7?

CVE-2026-53666 and CVE-2026-53669 have been backported to the v6 line in 6.30.6, so we can remediate without a major-version upgrade.

Test plan

• CI passes on the PR
• Confirm lockfile resolves only react-router@6.30.6 / react-router-dom@6.30.6
• Close Dependabot chore(deps): bump react-router from 6.30.4 to 7.18.2 in /packages/app #5431 as superseded after merge

Made with Cursor

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5525
• quay.io/rhdh-community/rhdh:pr-5525-7dc66e8e

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.86%. Comparing base (e2aaa59) to head (7dc66e8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5525      +/-   ##
==========================================
- Coverage   70.54%   62.86%   -7.68%     
==========================================
  Files          64       57       -7     
  Lines         740      587     -153     
  Branches      114       97      -17     
==========================================
- Hits          522      369     -153     
  Misses        217      217              
  Partials        1        1              

Flag	Coverage Δ
rhdh	62.86% <ø> (-7.68%)	⬇️

Components	Coverage Δ
Backend plugins	∅ <ø> (∅)
Backend app	69.69% <ø> (ø)
Frontend app	60.18% <ø> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e2aaa59...7dc66e8. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.