@c0va23/react-router-dev 7.9.6 → 7.13.0

package/CHANGELOG.md

@@ -1,5 +1,129 @@
 # `@react-router/dev`
 
+## 7.13.0
+
+### Patch Changes
+
+- Bump @remix-run/node-fetch-server dep ([#14704](https://github.com/remix-run/react-router/pull/14704))
+- Updated dependencies:
+  - `react-router@7.13.0`
+  - `@react-router/node@7.13.0`
+  - `@react-router/serve@7.13.0`
+
+## 7.12.0
+
+### Minor Changes
+
+- Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the `react-router.config.ts` config `allowedActionOrigins` field. ([#14708](https://github.com/remix-run/react-router/pull/14708))
+
+### Patch Changes
+
+- Fix `Maximum call stack size exceeded` errors when HMR is triggered against code with cyclic imports ([#14522](https://github.com/remix-run/react-router/pull/14522))
+
+- fix(vite): Skip SSR middleware in preview server for SPA mode ([#14673](https://github.com/remix-run/react-router/pull/14673))
+
+- \[UNSTABLE] Add a new `future.unstable_trailingSlashAwareDataRequests` flag to provide consistent behavior of `request.pathname` inside `middleware`, `loader`, and `action` functions on document and data requests when a trailing slash is present in the browser URL. ([#14644](https://github.com/remix-run/react-router/pull/14644))
+
+  Currently, your HTTP and `request` pathnames would be as follows for `/a/b/c` and `/a/b/c/`
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname\`** |
+  | ------------ | ----------------- | ------------------------ |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅               |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅               |
+
+  | URL `/a/b/c/` | **HTTP pathname** | **`request` pathname\`** |
+  | ------------- | ----------------- | ------------------------ |
+  | **Document**  | `/a/b/c/`         | `/a/b/c/` ✅              |
+  | **Data**      | `/a/b/c.data`     | `/a/b/c` ⚠️              |
+
+  With this flag enabled, these pathnames will be made consistent though a new `_.data` format for client-side `.data` requests:
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname\`** |
+  | ------------ | ----------------- | ------------------------ |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅               |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅               |
+
+  | URL `/a/b/c/` | **HTTP pathname**  | **`request` pathname\`** |
+  | ------------- | ------------------ | ------------------------ |
+  | **Document**  | `/a/b/c/`          | `/a/b/c/` ✅              |
+  | **Data**      | `/a/b/c/_.data` ⬅️ | `/a/b/c/` ✅              |
+
+  This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.
+
+  Enabling this flag also changes the format of client side `.data` requests from `/_root.data` to `/_.data` when navigating to `/` to align with the new format. This does not impact the `request` pathname which is still `/` in all cases.
+
+- Updated dependencies:
+  - `react-router@7.12.0`
+  - `@react-router/node@7.12.0`
+  - `@react-router/serve@7.12.0`
+
+## 7.11.0
+
+### Minor Changes
+
+- feat: add `vite preview` support ([#14507](https://github.com/remix-run/react-router/pull/14507))
+
+### Patch Changes
+
+- rsc framework mode manual chunking for react and react-router deps ([#14655](https://github.com/remix-run/react-router/pull/14655))
+- add support for throwing redirect Response's at RSC render time ([#14596](https://github.com/remix-run/react-router/pull/14596))
+- support custom entrypoints for RSC framework mode ([#14643](https://github.com/remix-run/react-router/pull/14643))
+- `routeRSCServerRequest` replace `fetchServer` with `serverResponse` ([#14597](https://github.com/remix-run/react-router/pull/14597))
+- rsc framewlrk mode - optimize react-server-dom-webpack if in project package.json ([#14656](https://github.com/remix-run/react-router/pull/14656))
+- Updated dependencies:
+  - `react-router@7.11.0`
+  - `@react-router/serve@7.11.0`
+  - `@react-router/node@7.11.0`
+
+## 7.10.1
+
+### Patch Changes
+
+- Import ESM package `pkg-types` with a dynamic `import()` to fix issues on Node 20.18 ([#14624](https://github.com/remix-run/react-router/pull/14624))
+- Update `valibot` dependency to `^1.2.0` to address [GHSA-vqpr-j7v3-hqw9](https://github.com/advisories/GHSA-vqpr-j7v3-hqw9) ([#14608](https://github.com/remix-run/react-router/pull/14608))
+- Updated dependencies:
+  - `react-router@7.10.1`
+  - `@react-router/node@7.10.1`
+  - `@react-router/serve@7.10.1`
+
+## 7.10.0
+
+### Minor Changes
+
+- Stabilize `future.v8_splitRouteModules`, replacing `future.unstable_splitRouteModules` ([#14595](https://github.com/remix-run/react-router/pull/14595))
+  - ⚠️ This is a breaking change if you have begun using `future.unstable_splitRouteModules`. Please update your `react-router.config.ts`.
+
+- Stabilize `future.v8_viteEnvironmentApi`, replacing `future.unstable_viteEnvironmentApi` ([#14595](https://github.com/remix-run/react-router/pull/14595))
+  - ⚠️ This is a breaking change if you have begun using `future.unstable_viteEnvironmentApi`. Please update your `react-router.config.ts`.
+
+### Patch Changes
+
+- Load environment variables before evaluating `routes.ts` ([#14446](https://github.com/remix-run/react-router/pull/14446))
+
+  For example, you can now compute your routes based on [`VITE_`-prefixed environment variables](https://vite.dev/guide/env-and-mode#env-variables):
+
+  ```txt
+  # .env
+  VITE_ENV_ROUTE=my-route
+  ```
+
+  ```ts
+  // app/routes.ts
+  import { type RouteConfig, route } from "@react-router/dev/routes";
+
+  const routes: RouteConfig = [];
+  if (import.meta.env.VITE_ENV_ROUTE === "my-route") {
+    routes.push(route("my-route", "routes/my-route.tsx"));
+  }
+
+  export default routes;
+  ```
+
+- Updated dependencies:
+  - `react-router@7.10.0`
+  - `@react-router/node@7.10.0`
+  - `@react-router/serve@7.10.0`
+
 ## 7.9.6
 
 ### Patch Changes
@@ -180,6 +304,7 @@
 - Stabilize middleware and context APIs. ([#14215](https://github.com/remix-run/react-router/pull/14215))
 
   We have removed the `unstable_` prefix from the following APIs and they are now considered stable and ready for production use:
+
   - [`RouterContextProvider`](https://reactrouter.com/api/utils/RouterContextProvider)
   - [`createContext`](https://reactrouter.com/api/utils/createContext)
   - `createBrowserRouter` [`getContext`](https://reactrouter.com/api/data-routers/createBrowserRouter#optsgetcontext) option
@@ -922,6 +1047,7 @@
   ```
 
   This initial implementation targets type inference for:
+
   - `Params` : Path parameters from your routing config in `routes.ts` including file-based routing
   - `LoaderData` : Loader data from `loader` and/or `clientLoader` within your route module
   - `ActionData` : Action data from `action` and/or `clientAction` within your route module
@@ -936,6 +1062,7 @@
   ```
 
   Check out our docs for more:
+
   - [_Explanations > Type Safety_](https://reactrouter.com/dev/guides/explanation/type-safety)
   - [_How-To > Setting up type safety_](https://reactrouter.com/dev/guides/how-to/setting-up-type-safety)
 
@@ -1135,6 +1262,7 @@
 - Vite: Provide `Unstable_ServerBundlesFunction` and `Unstable_VitePluginConfig` types ([#8654](https://github.com/remix-run/remix/pull/8654))
 
 - Vite: add `--sourcemapClient` and `--sourcemapServer` flags to `remix vite:build` ([#8613](https://github.com/remix-run/remix/pull/8613))
+
   - `--sourcemapClient`
 
   - `--sourcemapClient=inline`
@@ -1471,6 +1599,7 @@
 - Add support for `clientLoader`/`clientAction`/`HydrateFallback` route exports ([RFC](https://github.com/remix-run/remix/discussions/7634)) ([#8173](https://github.com/remix-run/remix/pull/8173))
 
   Remix now supports loaders/actions that run on the client (in addition to, or instead of the loader/action that runs on the server). While we still recommend server loaders/actions for the majority of your data needs in a Remix app - these provide some levers you can pull for more advanced use-cases such as:
+
   - Leveraging a data source local to the browser (i.e., `localStorage`)
   - Managing a client-side cache of server data (like `IndexedDB`)
   - Bypassing the Remix server in a BFF setup and hitting your API directly from the browser
@@ -1874,6 +2003,7 @@
 - Output esbuild metafiles for bundle analysis ([#6772](https://github.com/remix-run/remix/pull/6772))
 
   Written to server build directory (`build/` by default):
+
   - `metafile.css.json`
   - `metafile.js.json` (browser JS)
   - `metafile.server.json` (server JS)
@@ -1971,6 +2101,7 @@
 - built-in tls support ([#6483](https://github.com/remix-run/remix/pull/6483))
 
   New options:
+
   - `--tls-key` / `tlsKey`: TLS key
   - `--tls-cert` / `tlsCert`: TLS Certificate
 
@@ -2241,6 +2372,7 @@
   ```
 
   The dev server will:
+
   - force `NODE_ENV=development` and warn you if it was previously set to something else
   - rebuild your app whenever your Remix app code changes
   - restart your app server whenever rebuilds succeed

package/dist/cli/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * @react-router/dev v7.9.6
+ * @react-router/dev v7.13.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -492,13 +492,26 @@ async function resolveConfig({
       );
     }
   }
+  let futureConfig = userAndPresetConfigs.future;
+  if (futureConfig?.unstable_splitRouteModules !== void 0) {
+    return err(
+      'The "future.unstable_splitRouteModules" flag has been stabilized as "future.v8_splitRouteModules"'
+    );
+  }
+  if (futureConfig?.unstable_viteEnvironmentApi !== void 0) {
+    return err(
+      'The "future.unstable_viteEnvironmentApi" flag has been stabilized as "future.v8_viteEnvironmentApi"'
+    );
+  }
   let future = {
-    v8_middleware: userAndPresetConfigs.future?.v8_middleware ?? false,
     unstable_optimizeDeps: userAndPresetConfigs.future?.unstable_optimizeDeps ?? false,
-    unstable_splitRouteModules: userAndPresetConfigs.future?.unstable_splitRouteModules ?? false,
     unstable_subResourceIntegrity: userAndPresetConfigs.future?.unstable_subResourceIntegrity ?? false,
-    unstable_viteEnvironmentApi: userAndPresetConfigs.future?.unstable_viteEnvironmentApi ?? false
+    unstable_trailingSlashAwareDataRequests: userAndPresetConfigs.future?.unstable_trailingSlashAwareDataRequests ?? false,
+    v8_middleware: userAndPresetConfigs.future?.v8_middleware ?? false,
+    v8_splitRouteModules: userAndPresetConfigs.future?.v8_splitRouteModules ?? false,
+    v8_viteEnvironmentApi: userAndPresetConfigs.future?.v8_viteEnvironmentApi ?? false
   };
+  let allowedActionOrigins = userAndPresetConfigs.allowedActionOrigins ?? false;
   let reactRouterConfig = deepFreeze({
     appDirectory,
     basename: basename3,
@@ -512,6 +525,7 @@ async function resolveConfig({
     serverBundles,
     serverModuleFormat,
     ssr,
+    allowedActionOrigins,
     unstable_routeConfig: routeConfig
   });
   for (let preset of reactRouterUserConfig.presets ?? []) {
@@ -718,13 +732,12 @@ function isEntryFileDependency(moduleGraph, entryFilepath, filepath, visited = /
   }
   return false;
 }
-var import_node_fs, import_node_child_process, import_package_json, import_pathe3, import_chokidar, import_picocolors, import_pick2, import_omit, import_cloneDeep, import_isEqual, excludedConfigPresetKeys, mergeReactRouterConfig, deepFreeze, entryExts;
+var import_node_fs, import_node_child_process, import_pathe3, import_chokidar, import_picocolors, import_pick2, import_omit, import_cloneDeep, import_isEqual, excludedConfigPresetKeys, mergeReactRouterConfig, deepFreeze, entryExts;
 var init_config = __esm({
   "config/config.ts"() {
     "use strict";
     import_node_fs = __toESM(require("fs"));
     import_node_child_process = require("child_process");
-    import_package_json = __toESM(require("@npmcli/package-json"));
     init_vite_node();
     import_pathe3 = __toESM(require("pathe"));
     import_chokidar = __toESM(require("chokidar"));
@@ -946,6 +959,7 @@ function generateServerBuild(ctx) {
       export const routeDiscovery: ServerBuild["routeDiscovery"];
       export const routes: ServerBuild["routes"];
       export const ssr: ServerBuild["ssr"];
+      export const allowedActionOrigins: ServerBuild["allowedActionOrigins"];
       export const unstable_getCriticalCss: ServerBuild["unstable_getCriticalCss"];
     }
   `;
@@ -1363,11 +1377,9 @@ var init_has_rsc_plugin = __esm({
 });
 
 // vite/node-adapter.ts
-var import_node_fetch_server;
 var init_node_adapter = __esm({
   "vite/node-adapter.ts"() {
     "use strict";
-    import_node_fetch_server = require("@remix-run/node-fetch-server");
     init_invariant();
   }
 });
@@ -1673,8 +1685,8 @@ async function getEnvironmentOptionsResolvers(ctx, viteCommand) {
     return mergeEnvironmentOptions(getBaseOptions({ viteUserConfig }), {
       resolve: {
         external: (
-          // If `unstable_viteEnvironmentApi` is `true`, `resolve.external` is set in the `configEnvironment` hook
-          ctx.reactRouterConfig.future.unstable_viteEnvironmentApi ? void 0 : ssrExternals
+          // If `v8_viteEnvironmentApi` is `true`, `resolve.external` is set in the `configEnvironment` hook
+          ctx.reactRouterConfig.future.v8_viteEnvironmentApi ? void 0 : ssrExternals
         ),
         conditions: [...baseConditions, ...maybeDefaultServerConditions],
         externalConditions: [...baseConditions, ...defaultExternalConditions]
@@ -1689,7 +1701,7 @@ async function getEnvironmentOptionsResolvers(ctx, viteCommand) {
         copyPublicDir: false,
         // The client only uses assets in the public directory
         rollupOptions: {
-          input: (ctx.reactRouterConfig.future.unstable_viteEnvironmentApi ? viteUserConfig.environments?.ssr?.build?.rollupOptions?.input : viteUserConfig.build?.rollupOptions?.input) ?? virtual.serverBuild.id,
+          input: (ctx.reactRouterConfig.future.v8_viteEnvironmentApi ? viteUserConfig.environments?.ssr?.build?.rollupOptions?.input : viteUserConfig.build?.rollupOptions?.input) ?? virtual.serverBuild.id,
           output: {
             entryFileNames: serverBuildFile,
             format: serverModuleFormat
@@ -1714,14 +1726,14 @@ async function getEnvironmentOptionsResolvers(ctx, viteCommand) {
                 let code = (0, import_node_fs3.readFileSync)(routeFilePath, "utf-8");
                 return [
                   `${routeFilePath}${BUILD_CLIENT_ROUTE_QUERY_STRING}`,
-                  ...ctx.reactRouterConfig.future.unstable_splitRouteModules && !isRootRoute ? routeChunkExportNames.map(
+                  ...ctx.reactRouterConfig.future.v8_splitRouteModules && !isRootRoute ? routeChunkExportNames.map(
                     (exportName) => code.includes(exportName) ? getRouteChunkModuleId(routeFilePath, exportName) : null
                   ) : []
                 ].filter(isNonNullable);
               }
             )
           ],
-          output: (ctx.reactRouterConfig.future.unstable_viteEnvironmentApi ? viteUserConfig?.environments?.client?.build?.rollupOptions?.output : viteUserConfig?.build?.rollupOptions?.output) ?? {
+          output: (ctx.reactRouterConfig.future.v8_viteEnvironmentApi ? viteUserConfig?.environments?.client?.build?.rollupOptions?.output : viteUserConfig?.build?.rollupOptions?.output) ?? {
             entryFileNames: ({ moduleIds }) => {
               let routeChunkModuleId = moduleIds.find(isRouteChunkModuleId);
               let routeChunkName = routeChunkModuleId ? getRouteChunkNameFromModuleId(routeChunkModuleId)?.replace(
@@ -1729,7 +1741,7 @@ async function getEnvironmentOptionsResolvers(ctx, viteCommand) {
                 ""
               ) : null;
               let routeChunkSuffix = routeChunkName ? `-${(0, import_kebabCase.default)(routeChunkName)}` : "";
-              let assetsDir = (ctx.reactRouterConfig.future.unstable_viteEnvironmentApi ? viteUserConfig?.environments?.client?.build?.assetsDir : null) ?? viteUserConfig?.build?.assetsDir ?? "assets";
+              let assetsDir = (ctx.reactRouterConfig.future.v8_viteEnvironmentApi ? viteUserConfig?.environments?.client?.build?.assetsDir : null) ?? viteUserConfig?.build?.assetsDir ?? "assets";
               return path7.posix.join(
                 assetsDir,
                 `[name]${routeChunkSuffix}-[hash].js`
@@ -1780,7 +1792,7 @@ function resolveEnvironmentsOptions(environmentResolvers, resolverOptions) {
 function isNonNullable(x) {
   return x != null;
 }
-var import_node_crypto, import_node_fs3, import_promises2, path7, url, babel2, import_node_fetch_server2, import_react_router2, import_es_module_lexer, import_pick3, import_jsesc, import_picocolors5, import_kebabCase, CLIENT_NON_COMPONENT_EXPORTS, CLIENT_ROUTE_EXPORTS, BUILD_CLIENT_ROUTE_QUERY_STRING, SSR_BUNDLE_PREFIX, virtualHmrRuntime, virtualInjectHmrRuntime, virtual, getServerBuildDirectory, getClientBuildDirectory, defaultEntriesDir, defaultEntries, REACT_REFRESH_HEADER;
+var import_node_crypto, import_node_fs3, import_promises2, path7, url, babel2, import_react_router2, import_es_module_lexer, import_pick3, import_jsesc, import_picocolors5, import_kebabCase, CLIENT_NON_COMPONENT_EXPORTS, CLIENT_ROUTE_EXPORTS, BUILD_CLIENT_ROUTE_QUERY_STRING, SSR_BUNDLE_PREFIX, virtualHmrRuntime, virtualInjectHmrRuntime, virtual, getServerBuildDirectory, getClientBuildDirectory, defaultEntriesDir, defaultEntries, REACT_REFRESH_HEADER;
 var init_plugin = __esm({
   "vite/plugin.ts"() {
     "use strict";
@@ -1790,7 +1802,6 @@ var init_plugin = __esm({
     path7 = __toESM(require("path"));
     url = __toESM(require("url"));
     babel2 = __toESM(require("@babel/core"));
-    import_node_fetch_server2 = require("@remix-run/node-fetch-server");
     import_react_router2 = require("react-router");
     import_es_module_lexer = require("es-module-lexer");
     import_pick3 = __toESM(require("lodash/pick"));
@@ -1902,12 +1913,12 @@ async function build(root, viteBuildOptions) {
   }
   let config = configResult.value;
   let viteMajor = parseInt(vite2.version.split(".")[0], 10);
-  if (config.future.unstable_viteEnvironmentApi && viteMajor === 5) {
+  if (config.future.v8_viteEnvironmentApi && viteMajor === 5) {
     throw new Error(
-      "The future.unstable_viteEnvironmentApi option is not supported in Vite 5"
+      "The future.v8_viteEnvironmentApi option is not supported in Vite 5"
     );
   }
-  const useViteEnvironmentApi = config.future.unstable_viteEnvironmentApi || await hasReactRouterRscPlugin({ root, viteBuildOptions });
+  const useViteEnvironmentApi = config.future.v8_viteEnvironmentApi || await hasReactRouterRscPlugin({ root, viteBuildOptions });
   return await (useViteEnvironmentApi ? viteAppBuild(root, viteBuildOptions) : viteBuild(root, viteBuildOptions));
 }
 async function viteAppBuild(root, {
@@ -2142,7 +2153,6 @@ var import_picocolors9 = __toESM(require("picocolors"));
 var import_node_fs4 = require("fs");
 var import_promises3 = require("fs/promises");
 var path8 = __toESM(require("path"));
-var import_package_json2 = __toESM(require("@npmcli/package-json"));
 var import_exit_hook = __toESM(require("exit-hook"));
 var import_picocolors8 = __toESM(require("picocolors"));
 var import_react_router3 = require("react-router");
@@ -2308,8 +2318,9 @@ async function generateEntry(entry, rootDirectory, flags = {}) {
     );
     return;
   }
-  let pkgJson = await import_package_json2.default.load(rootDirectory);
-  let deps = pkgJson.content.dependencies ?? {};
+  let { readPackageJSON } = await import("pkg-types");
+  let pkgJson = await readPackageJSON(rootDirectory);
+  let deps = pkgJson.dependencies ?? {};
   if (!deps["@react-router/node"]) {
     console.error(import_picocolors8.default.red(`No default server entry detected.`));
     return;

package/dist/config/default-rsc-entries/entry.rsc.tsx

@@ -6,22 +6,36 @@ import {
   loadServerAction,
   renderToReadableStream,
 } from "@vitejs/plugin-rsc/rsc";
-import { unstable_matchRSCServerRequest as matchRSCServerRequest } from "react-router";
+import {
+  RouterContextProvider,
+  unstable_matchRSCServerRequest as matchRSCServerRequest,
+} from "react-router";
 
+// Import the routes generated by routes.ts
 import routes from "virtual:react-router/unstable_rsc/routes";
 import basename from "virtual:react-router/unstable_rsc/basename";
 import unstable_reactRouterServeConfig from "virtual:react-router/unstable_rsc/react-router-serve-config";
 
-export async function fetchServer(request: Request) {
-  return await matchRSCServerRequest({
+export { unstable_reactRouterServeConfig };
+
+export function fetchServer(
+  request: Request,
+  requestContext?: RouterContextProvider,
+) {
+  return matchRSCServerRequest({
+    basename,
+    // Provide the React Server touchpoints.
     createTemporaryReferenceSet,
     decodeAction,
     decodeFormState,
     decodeReply,
     loadServerAction,
+    // The incoming request.
     request,
+    requestContext,
+    // The app routes.
     routes,
-    basename,
+    // Encode the match with the React Server implementation.
     generateResponse(match, options) {
       return new Response(renderToReadableStream(match.payload, options), {
         status: match.statusCode,
@@ -31,14 +45,22 @@ export async function fetchServer(request: Request) {
   });
 }
 
-export { unstable_reactRouterServeConfig };
+export default {
+  async fetch(request: Request, requestContext?: RouterContextProvider) {
+    if (requestContext && !(requestContext instanceof RouterContextProvider)) {
+      requestContext = undefined;
+    }
 
-export default async function handler(request: Request) {
-  const ssr = await import.meta.viteRsc.loadModule<
-    typeof import("./entry.ssr")
-  >("ssr", "index");
-  return ssr.default(request, fetchServer);
-}
+    const ssr = await import.meta.viteRsc.loadModule<
+      typeof import("./entry.ssr.tsx")
+    >("ssr", "index");
+
+    return await ssr.generateHTML(
+      request,
+      await fetchServer(request, requestContext),
+    );
+  },
+};
 
 if (import.meta.hot) {
   import.meta.hot.accept();

package/dist/config/default-rsc-entries/entry.ssr.tsx

@@ -1,31 +1,38 @@
 import { createFromReadableStream } from "@vitejs/plugin-rsc/ssr";
-// @ts-expect-error
-import * as ReactDomServer from "react-dom/server.edge";
+// @ts-expect-error - no types for this, can import from root once on latest 19
+import { renderToReadableStream } from "react-dom/server.edge";
 import {
-  unstable_RSCStaticRouter as RSCStaticRouter,
   unstable_routeRSCServerRequest as routeRSCServerRequest,
+  unstable_RSCStaticRouter as RSCStaticRouter,
 } from "react-router";
 
-export default async function handler(
+export async function generateHTML(
   request: Request,
-  fetchServer: (request: Request) => Promise<Response>,
-) {
-  const bootstrapScriptContent =
-    await import.meta.viteRsc.loadBootstrapScriptContent("index");
-
-  return routeRSCServerRequest({
+  serverResponse: Response,
+): Promise<Response> {
+  return await routeRSCServerRequest({
+    // The incoming request.
     request,
-    fetchServer,
+    // The response from the RSC server.
+    serverResponse,
+    // Provide the React Server touchpoints.
     createFromReadableStream,
-    async renderHTML(getPayload) {
-      const payload = getPayload();
+    // Render the router to HTML.
+    async renderHTML(getPayload, options) {
+      const payload = await getPayload();
+      const formState =
+        payload.type === "render" ? await payload.formState : undefined;
+
+      const bootstrapScriptContent =
+        await import.meta.viteRsc.loadBootstrapScriptContent("index");
 
-      return ReactDomServer.renderToReadableStream(
+      return await renderToReadableStream(
         <RSCStaticRouter getPayload={getPayload} />,
         {
+          ...options,
           bootstrapScriptContent,
+          formState,
           signal: request.signal,
-          formState: await payload.formState,
         },
       );
     },

package/dist/config.d.ts

@@ -37,20 +37,21 @@ type ServerBundlesBuildManifest = BaseBuildManifest & {
 };
 type ServerModuleFormat = "esm" | "cjs";
 interface FutureConfig {
+    unstable_optimizeDeps: boolean;
+    unstable_subResourceIntegrity: boolean;
+    unstable_trailingSlashAwareDataRequests: boolean;
     /**
      * Enable route middleware
      */
     v8_middleware: boolean;
-    unstable_optimizeDeps: boolean;
     /**
      * Automatically split route modules into multiple chunks when possible.
      */
-    unstable_splitRouteModules: boolean | "enforce";
-    unstable_subResourceIntegrity: boolean;
+    v8_splitRouteModules: boolean | "enforce";
     /**
-     * Use Vite Environment API (experimental)
+     * Use Vite Environment API
      */
-    unstable_viteEnvironmentApi: boolean;
+    v8_viteEnvironmentApi: boolean;
 }
 type BuildManifest = DefaultBuildManifest | ServerBundlesBuildManifest;
 type BuildEndHook = (args: {
@@ -147,6 +148,47 @@ type ReactRouterConfig = {
      * SPA without server-rendering. Default's to `true`.
      */
     ssr?: boolean;
+    /**
+     * An array of allowed origin hosts for action submissions to UI routes (does not apply
+     * to resource routes). Supports micromatch glob patterns (`*` to match one segment,
+     * `**` to match multiple).
+     *
+     * ```tsx
+     * export default {
+     *   allowedActionOrigins: [
+     *     "example.com",
+     *     "*.example.com", // sub.example.com
+     *     "**.example.com", // sub.domain.example.com
+     *   ],
+     * } satisfies Config;
+     * ```
+     *
+     * If you need to set this value at runtime, you can do in by setting the value
+     * on the server build in your custom server. For example, when using `express`:
+     *
+     * ```ts
+     * import express from "express";
+     * import { createRequestHandler } from "@react-router/express";
+     * import type { ServerBuild } from "react-router";
+     *
+     * export const app = express();
+     *
+     * async function getBuild() {
+     *   let build: ServerBuild = await import(
+     *     "virtual:react-router/server-build"
+     *   );
+     *   return {
+     *     ...build,
+     *     allowedActionOrigins:
+     *       process.env.NODE_ENV === "development"
+     *         ? undefined
+     *         : ["staging.example.com", "www.example.com"],
+     *   };
+     * }
+     *
+     * app.use(createRequestHandler({ build: getBuild }));
+     */
+    allowedActionOrigins?: string[];
 };
 type ResolvedReactRouterConfig = Readonly<{
     /**
@@ -212,6 +254,11 @@ type ResolvedReactRouterConfig = Readonly<{
      * SPA without server-rendering. Default's to `true`.
      */
     ssr: boolean;
+    /**
+     * The allowed origins for actions / mutations. Does not apply to routes
+     * without a component. micromatch glob patterns are supported.
+     */
+    allowedActionOrigins: string[] | false;
     /**
      * The resolved array of route config entries exported from `routes.ts`
      */

package/dist/config.js

@@ -1,5 +1,5 @@
 /**
- * @react-router/dev v7.9.6
+ * @react-router/dev v7.13.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/routes.js

@@ -1,5 +1,5 @@
 /**
- * @react-router/dev v7.9.6
+ * @react-router/dev v7.13.0
  *
  * Copyright (c) Remix Software Inc.
  *