[pull] main from cloudflare:main

.changeset/bump-undici-7-28-0.md

@@ -0,0 +1,11 @@
+---
+"@cloudflare/deploy-helpers": patch
+"@cloudflare/vitest-pool-workers": patch
+"@cloudflare/workers-auth": patch
+"@cloudflare/workers-utils": patch
+"create-cloudflare": patch
+"miniflare": patch
+"wrangler": patch
+---
+
+Update undici from 7.24.8 to 7.28.0

.changeset/bump-ws-8-21-0.md

@@ -0,0 +1,9 @@
+---
+"miniflare": patch
+"wrangler": patch
+"@cloudflare/vite-plugin": patch
+---
+
+Bump `ws` from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p
+
+[GHSA-96hv-2xvq-fx4p](https://github.com/advisories/GHSA-96hv-2xvq-fx4p) / [CVE-2026-48779](https://www.cve.org/CVERecord?id=CVE-2026-48779) (high severity) reports a remote memory-exhaustion DoS in `ws@<8.21.0`: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a `ws` server or client via OOM. The fix shipped in [ws@8.21.0](https://github.com/websockets/ws/releases/tag/8.21.0) (commit `2b2abd45`, released 2026-05-22), which also introduces the `maxBufferedChunks` and `maxFragments` options. This change bumps the workspace catalog entry so that `miniflare`, `wrangler`, and `@cloudflare/vite-plugin` all pick up the patched release.

.changeset/wise-planets-stare.md

@@ -0,0 +1,5 @@
+---
+"create-cloudflare": patch
+---
+
+Upgrade `create-react-router` to `8.0.0` and prevent React Router template overriding v8 dependencies

packages/create-cloudflare/e2e/tests/frameworks/test-config.ts

@@ -943,6 +943,7 @@ function getExperimentalFrameworkTestConfig(
 		},
 		{
 			name: "react-router",
+			quarantine: true,
 			unsupportedOSs: ["win32"],
 			testCommitMessage: true,
 			timeout: LONG_TIMEOUT,

packages/create-cloudflare/src/frameworks/package.json

@@ -9,7 +9,7 @@
 		"create-hono": "0.19.4",
 		"create-next-app": "16.2.9",
 		"create-qwik": "1.20.0",
-		"create-react-router": "7.17.0",
+		"create-react-router": "8.0.0",
 		"create-rwsdk": "3.1.3",
 		"create-solid": "0.7.0",
 		"create-vike": "0.0.651",

packages/create-cloudflare/templates/react-router/c3.ts

@@ -67,12 +67,6 @@ const config: TemplateConfig = {
 	generate,
 	configure,
 	transformPackageJson: async () => ({
-		dependencies: {
-			"react-router": "^7.10.0",
-		},
-		devDependencies: {
-			"@react-router/dev": "^7.10.0",
-		},
 		scripts: {
 			deploy: `${npm} run build && wrangler deploy`,
 			preview: `${npm} run build && vite preview`,