[Bug]: Resolve react-router security update blocked by dependency constraints

[JJordan0C]

Summary

Dependabot cannot create a security update PR for react-router. The current react-router-dom@7.18.1 dependency pins react-router@7.18.1, while the patched release is react-router@8.3.0 and no matching react-router-dom@8.3.0 package is available.

The update therefore requires a manual migration, and the Dependabot update job remains failed.

Reproduction

1. Start from the current main branch.
2. Trigger the open Dependabot security update for react-router.
3. Open the generated Dependabot Updates run.
4. Observe that the job fails with security_update_not_possible and reports 7.18.1 as the latest resolvable version.

Expected behavior

Needle should use a supported patched dependency combination, resolve the Dependabot alert, and complete future dependency update jobs without this resolver failure.

Environment

Needle commit: c5e6ee4
Package ecosystem: npm
Manifest: crates/needle-app/web/package.json
Current dependency: react-router-dom@7.18.1
Resolved transitive dependency: react-router@7.18.1
Patched target: react-router@8.3.0

Affected area

Web control plane, Packaging, compatibility, or CI

Diagnostics

Dependabot error: security_update_not_possible
Latest resolvable version: 7.18.1
Conflicting dependency: react-router-dom@7.18.1

Run: https://github.com/IASolutionOrg/Needle/actions/runs/30921565900

Additional context

No response

Submission checks

• I checked PROJECT_STATUS.md and this is not a documented unsupported behavior.
• I searched existing issues for the same problem.
• This report contains no credentials, private source, sealed benchmark data, or vulnerability details.