chore(deps): bump RR7 to v7.12.0

[kdaviduik]

WHAT is this pull request doing?

Update React Router to 7.12.0 with stabilized future flags

This release uses React Router's newly stabilized future flags (v8_splitRouteModules, v8_middleware) instead of their unstable counterparts

HOW to test your changes?

git fetch origin kd-bump-rr7
git checkout kd-bump-rr7
npm ci

^ should succeed with no errors or warnings

Post-merge steps

Update the h2 upgrade changelog to include upgrade instructions

Checklist

• I've read the Contributing Guidelines
• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've added a changeset if this PR contains user-facing or noteworthy changes
• I've added tests to cover my changes
• I've added or updated the documentation

[shopify]

Oxygen deployed a preview of your kd-bump-rr7 branch. Details:

Storefront	Status	Preview link	Deployment details	Last update (UTC)
Skeleton (skeleton.hydrogen.shop)	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 8, 2026 4:17 AM
sitemap	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 8, 2026 4:18 AM
third-party-queries-caching	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 8, 2026 4:18 AM
metaobjects	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 8, 2026 4:18 AM
custom-cart-method	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 8, 2026 4:19 AM

Learn more about Hydrogen's GitHub integration.

[fredericoo]

lgtm!

[frandiox]

Perhaps we should wait to merge this until cookies are released?

[brookslybrand]

I don't know y'all's release flow, will this PR bump the @shopify/hydrogen version? If so, does this dep also need to be bumped in the various package.json?

[kdaviduik]

So merging this PR won't release anything, but it will update this 2025.7.1 release PR. And merging that 2025.7.1 release PR will actually publish the new Hydrogen version on npm, and also update this dependency here automatically to 2025.7.1 :)

[brookslybrand]

Looks good! I just had one question

[brophdawg11]

I'm not quite sure what these patches are for but we recently updated compression/morgan to address an underlying CVE (remix-run/react-router#14652) so if they are being patched it should meet those new minimum versions. But ideally they don't need to be patched?

[kdaviduik]

Currently, these patches are just used as "recipes" in the dev docs. Here is the link to this specific one. I will bump this morgan version in the express recipe as a follow-up so it reflects best practices for security :) Thanks Matt!