react-router 7.12.0 → 7.13.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # `react-router`
 
+## 7.13.0
+
+### Minor Changes
+
+- Add `crossOrigin` prop to `Links` component ([#14687](https://github.com/remix-run/react-router/pull/14687))
+
+### Patch Changes
+
+- Fix double slash normalization for useNavigate colon urls ([#14718](https://github.com/remix-run/react-router/pull/14718))
+- Update failed origin checks to return a 400 status instead of a 500 ([#14737](https://github.com/remix-run/react-router/pull/14737))
+- Bugfix #14666: Inline criticalCss is missing nonce ([#14691](https://github.com/remix-run/react-router/pull/14691))
+- Loosen `allowedActionOrigins` glob check so `**` matches all domains ([#14722](https://github.com/remix-run/react-router/pull/14722))
+
 ## 7.12.0
 
 ### Minor Changes

package/dist/{production/chunk-QCD7HIN2.mjs → development/chunk-4LKRSAEJ.mjs}

@@ -1,5 +1,5 @@
 /**
- * react-router v7.12.0
+ * react-router v7.13.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -51,7 +51,7 @@ import {
   withComponentProps,
   withErrorBoundaryProps,
   withHydrateFallbackProps
-} from "./chunk-DZM3VO5F.mjs";
+} from "./chunk-JZWAC4HX.mjs";
 
 // lib/dom/ssr/server.tsx
 import * as React from "react";
@@ -783,9 +783,6 @@ function matchWildcardDomain(domain, pattern) {
   if (domainParts.length < patternParts.length) {
     return false;
   }
-  if (patternParts.length === 1 && (patternParts[0] === "*" || patternParts[0] === "**")) {
-    return false;
-  }
   while (patternParts.length) {
     const patternPart = patternParts.pop();
     const domainPart = domainParts.pop();
@@ -841,10 +838,14 @@ var SERVER_NO_BODY_STATUS_CODES = /* @__PURE__ */ new Set([
 ]);
 async function singleFetchAction(build, serverMode, staticHandler, request, handlerUrl, loadContext, handleError) {
   try {
-    throwIfPotentialCSRFAttack(
-      request.headers,
-      Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []
-    );
+    try {
+      throwIfPotentialCSRFAttack(
+        request.headers,
+        Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []
+      );
+    } catch (e) {
+      return handleQueryError(new Error("Bad Request"), 400);
+    }
     let handlerRequest = new Request(handlerUrl, {
       method: request.method,
       body: request.body,
@@ -872,12 +873,12 @@ async function singleFetchAction(build, serverMode, staticHandler, request, hand
   function handleQueryResult(result) {
     return isResponse(result) ? result : staticContextToResponse(result);
   }
-  function handleQueryError(error) {
+  function handleQueryError(error, status = 500) {
     handleError(error);
     return generateSingleFetchResponse(request, build, serverMode, {
       result: { error },
       headers: new Headers(),
-      status: 500
+      status
     });
   }
   function staticContextToResponse(context) {
@@ -1396,10 +1397,15 @@ async function handleSingleFetchRequest(serverMode, build, staticHandler, reques
 async function handleDocumentRequest(serverMode, build, staticHandler, request, loadContext, handleError, isSpaMode, criticalCss) {
   try {
     if (request.method === "POST") {
-      throwIfPotentialCSRFAttack(
-        request.headers,
-        Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []
-      );
+      try {
+        throwIfPotentialCSRFAttack(
+          request.headers,
+          Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []
+        );
+      } catch (e) {
+        handleError(e);
+        return new Response("Bad Request", { status: 400 });
+      }
     }
     let result = await staticHandler.query(request, {
       requestContext: loadContext,

package/dist/development/{chunk-G2I2SRFA.js → chunk-7PAHGFS4.js}

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }/**
- * react-router v7.12.0
+ * react-router v7.13.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -14,7 +14,7 @@
 
 
 
-var _chunk2BEI23B2js = require('./chunk-2BEI23B2.js');
+var _chunkWICQJKU6js = require('./chunk-WICQJKU6.js');
 
 // lib/dom/ssr/hydration.tsx
 function getHydrationData({
@@ -29,12 +29,12 @@ function getHydrationData({
     ...state,
     loaderData: { ...state.loaderData }
   };
-  let initialMatches = _chunk2BEI23B2js.matchRoutes.call(void 0, routes, location, basename);
+  let initialMatches = _chunkWICQJKU6js.matchRoutes.call(void 0, routes, location, basename);
   if (initialMatches) {
     for (let match of initialMatches) {
       let routeId = match.route.id;
       let routeInfo = getRouteInfo(routeId);
-      if (_chunk2BEI23B2js.shouldHydrateRouteLoader.call(void 0, 
+      if (_chunkWICQJKU6js.shouldHydrateRouteLoader.call(void 0, 
         routeId,
         routeInfo.clientLoader,
         routeInfo.hasLoader,
@@ -112,7 +112,7 @@ function RSCDefaultRootErrorBoundaryImpl({
       }
     }
   );
-  if (_chunk2BEI23B2js.isRouteErrorResponse.call(void 0, error)) {
+  if (_chunkWICQJKU6js.isRouteErrorResponse.call(void 0, error)) {
     return /* @__PURE__ */ _react2.default.createElement(
       ErrorWrapper,
       {
@@ -120,7 +120,7 @@ function RSCDefaultRootErrorBoundaryImpl({
         title: "Unhandled Thrown Response!"
       },
       /* @__PURE__ */ _react2.default.createElement("h1", { style: { fontSize: "24px" } }, error.status, " ", error.statusText),
-      _chunk2BEI23B2js.ENABLE_DEV_WARNINGS ? heyDeveloper : null
+      _chunkWICQJKU6js.ENABLE_DEV_WARNINGS ? heyDeveloper : null
     );
   }
   let errorInstance;
@@ -146,7 +146,7 @@ function RSCDefaultRootErrorBoundaryImpl({
 function RSCDefaultRootErrorBoundary({
   hasRootLayout
 }) {
-  let error = _chunk2BEI23B2js.useRouteError.call(void 0, );
+  let error = _chunkWICQJKU6js.useRouteError.call(void 0, );
   if (hasRootLayout === void 0) {
     throw new Error("Missing 'hasRootLayout' prop");
   }