[sbc1-code]

React Router 6.30.6 is in the affected ranges for GHSA-wrjc-x8rr-h8h6 and GHSA-337j-9hxr-rhxg. Upgrade react-router-dom/react-router to the verified 7.18.4 release (maintainer fixes start at 7.18.0); no patched 6.x version was confirmed. The separately discussed 6.1.5 backport is postcss-selector-parser, not Router. Keep the minimal dependency/lock change in 9c2d30d, regression evidence in fe9ae12, and the bounded performance follow-up in e0bac72.

The first dependency candidate exceeded the unchanged 62 KiB entry budget. Load the existing closed dashboard summary/chart only on first opening, keep it mounted on close/reopen and current with filters/data, and show localized loading/asset-failure status while reports and navigation stay usable. Make unused local dropdown wrappers removable through a pure ref/name factory, retaining every export, ref, style and menu action. No Router validation is stripped and no vendor bytes are hidden by changing chunk configuration.

Measured entry: 68,623 → 63,169 gzip bytes (61.6885 KiB, 319 bytes below the existing cap). Counting every initially requested JS chunk: 285,958 → 280,504 bytes, a real 5,454-byte reduction. First opening adds one 5,861-byte gzip chunk with no vendor waterfall; all-route gzip totals increase by 426 bytes. Cold diagnostic samples at 150ms latency and 200KiB/s download show first opening 0.30–1.34s versus 0.02–0.05s before; the loading state and usable reports are tested explicitly. This on-request cost is confined to previously hidden work, not presented as a production speed or conversion gain.

Validation: locked install and fresh build PASS; 130/130 standalone unit tests; full npm test PASS, including unchanged audit/bundle gates and 402 route navigations. Added EN/ES desktop/mobile checks for held/failed asset loading and recovery, keyboard map selection, retained chart state, current filters, menu lane/route actions and Escape focus. Router API regressions cover mixed separators, external-target rejection, internal query/hash/replace/Back/Forward and encoded internal parameters. Existing Compare aging/recovery, historical evidence, storage/favorites, sharing/feedback, keyboard, metadata and alias regressions pass. Raw audit is 6 moderate build-chain entries, 0 high/critical, with Router entries absent; no complete security/accessibility certification.

Original 18 changes and all prior worktrees are preserved. No build configuration, budget/audit script, security exception, credentials, permissions, ads, service or monitor changes. Release only after remote CI succeeds on this head and concurrent-source readback, using the existing publication workflow once. Rollback via a scoped inverse/revert PR for this series, preserving newer collector inputs; do not roll the data bundle back.