react-router 7.16.0 → 7.18.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # `react-router`
 
+## v7.18.0
+
+### Patch Changes
+
+- Fix server handler prerender responses when using `ssr: false` and `future.v8_trailingSlashAwareDataRequests: true`. Avoids false positive "SPA Mode" detection when serving prerendered paths ([#15173](https://github.com/remix-run/react-router/pull/15173))
+- Use the `ServerRouter` nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. ([#15170](https://github.com/remix-run/react-router/pull/15170))
+- Use `turbo-stream` to serialize and deserialize Framework Mode hydration errors ([#15175](https://github.com/remix-run/react-router/pull/15175))
+- Precompute route branch matchers to avoid recompiling route path regexes during matching ([#15186](https://github.com/remix-run/react-router/pull/15186))
+- Use the constructed request URL host when validating action request origins. ([#15185](https://github.com/remix-run/react-router/pull/15185))
+- Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows ([#15175](https://github.com/remix-run/react-router/pull/15175))
+- Validate protocols in RSC render redirects ([#15177](https://github.com/remix-run/react-router/pull/15177))
+- Consolidate url normalization logic and better handle mixed slashes ([#15176](https://github.com/remix-run/react-router/pull/15176))
+
+## v7.17.0
+
+### Minor Changes
+
+- Ship a subset of the official documentation inside the `react-router` package ([#15121](https://github.com/remix-run/react-router/pull/15121))
+  - Markdown docs are now available in `node_modules/react-router/docs`, letting AI coding agents and the React Router agent skills read official docs locally
+  - Excludes auto-generated API docs (`api/`), `community/` content, and tutorials (`tutorials/`)
+
 ## v7.16.0
 
 ### Minor Changes
@@ -11,7 +32,6 @@
 - Disable manifest path when lazy route dicovery is disabled ([#15068](https://github.com/remix-run/react-router/pull/15068))
 
 - Fix browser URL creation to use the configured history window instead of the global window. ([#15066](https://github.com/remix-run/react-router/pull/15066))
-
   - Pass the history/router window through to `createBrowserURLImpl` so custom window contexts keep the correct URL origin.
 
 - Fix `useNavigation()` return type to preserve discriminated union across navigation states ([#15095](https://github.com/remix-run/react-router/pull/15095))

package/dist/development/{browser-D3uq9sI1.d.ts → browser-B2PdsXXH.d.ts}

@@ -1,6 +1,6 @@
 import * as React from 'react';
-import { R as RouterInit } from './instrumentation-1q4YhLGP.js';
-import { L as Location, C as ClientActionFunction, a as ClientLoaderFunction, b as LinksFunction, M as MetaFunction, S as ShouldRevalidateFunction, P as Params, c as RouterContextProvider, A as ActionFunction, H as HeadersFunction, d as LoaderFunction } from './data-D4xhSy90.js';
+import { R as RouterInit } from './instrumentation-Dkmpzd13.js';
+import { L as Location, C as ClientActionFunction, a as ClientLoaderFunction, b as LinksFunction, M as MetaFunction, S as ShouldRevalidateFunction, P as Params, c as RouterContextProvider, A as ActionFunction, H as HeadersFunction, d as LoaderFunction } from './data-CjO11-hU.js';
 
 declare function getRequest(): Request;
 type RSCRouteConfigEntryBase = {

package/dist/development/{browser-nIQ4Nsyi.d.mts → browser-DBmQ1yAR.d.mts}

@@ -1,6 +1,6 @@
 import * as React from 'react';
-import { R as RouterInit } from './context-m8rizgnE.mjs';
-import { L as Location, C as ClientActionFunction, a as ClientLoaderFunction, b as LinksFunction, M as MetaFunction, S as ShouldRevalidateFunction, P as Params, c as RouterContextProvider, A as ActionFunction, H as HeadersFunction, d as LoaderFunction } from './data-U8FS-wNn.mjs';
+import { R as RouterInit } from './context-CeD5LmaF.mjs';
+import { L as Location, C as ClientActionFunction, a as ClientLoaderFunction, b as LinksFunction, M as MetaFunction, S as ShouldRevalidateFunction, P as Params, c as RouterContextProvider, A as ActionFunction, H as HeadersFunction, d as LoaderFunction } from './data-DEjBmEfD.mjs';
 
 declare function getRequest(): Request;
 type RSCRouteConfigEntryBase = {

package/dist/development/{chunk-QUQL4437.mjs → chunk-4ZMWKKQ3.mjs}

@@ -1,5 +1,5 @@
 /**
- * react-router v7.16.0
+ * react-router v7.18.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -16,6 +16,13 @@ var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read fr
 var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
 
+// lib/router/url.ts
+var ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|[\\/]{2})/i;
+var PROTOCOL_RELATIVE_URL_REGEX = /^[\\/]{2}/;
+function normalizeProtocolRelativeUrl(url, protocol) {
+  return protocol + url.replace(/\\/g, "/");
+}
+
 // lib/router/history.ts
 var Action = /* @__PURE__ */ ((Action2) => {
   Action2["Pop"] = "POP";
@@ -373,7 +380,7 @@ function createBrowserURLImpl(windowImpl, to, isAbsolute = false) {
   invariant(base, "No window.location.(origin|href) available to create URL");
   let href = typeof to === "string" ? to : createPath(to);
   href = href.replace(/ $/, "%20");
-  if (!isAbsolute && href.startsWith("//")) {
+  if (!isAbsolute && PROTOCOL_RELATIVE_URL_REGEX.test(href)) {
     href = base + href;
   }
   return new URL(href, base);
@@ -591,7 +598,18 @@ function flattenRoutes(routes, branches = [], parentsMeta = [], parentPath = "",
     branches.push({
       path,
       score: computeScore(path, route.index),
-      routesMeta
+      routesMeta: routesMeta.map((meta2, i) => {
+        let [matcher, params] = compilePath(
+          meta2.relativePath,
+          meta2.caseSensitive,
+          i === routesMeta.length - 1
+        );
+        return {
+          ...meta2,
+          matcher,
+          compiledParams: params
+        };
+      })
     });
   };
   routes.forEach((route, index) => {
@@ -680,9 +698,19 @@ function matchRouteBranch(branch, pathname, allowPartial = false) {
     let meta = routesMeta[i];
     let end = i === routesMeta.length - 1;
     let remainingPathname = matchedPathname === "/" ? pathname : pathname.slice(matchedPathname.length) || "/";
-    let match = matchPath(
-      { path: meta.relativePath, caseSensitive: meta.caseSensitive, end },
-      remainingPathname
+    let pattern = {
+      path: meta.relativePath,
+      caseSensitive: meta.caseSensitive,
+      end
+    };
+    let match = (
+      // Use precomputed matcher if it exists
+      meta.matcher && meta.compiledParams ? matchPathImpl(
+        pattern,
+        remainingPathname,
+        meta.matcher,
+        meta.compiledParams
+      ) : matchPath(pattern, remainingPathname)
     );
     let route = meta.route;
     if (!match && end && allowPartial && !routesMeta[routesMeta.length - 1].route.index) {
@@ -750,6 +778,9 @@ function matchPath(pattern, pathname) {
     pattern.caseSensitive,
     pattern.end
   );
+  return matchPathImpl(pattern, pathname, matcher, compiledParams);
+}
+function matchPathImpl(pattern, pathname, matcher, compiledParams) {
   let match = pathname.match(matcher);
   if (!match) return null;
   let matchedPathname = match[0];
@@ -839,7 +870,6 @@ function prependBasename({
 }) {
   return pathname === "/" ? basename : joinPaths([basename, pathname]);
 }
-var ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
 var isAbsoluteUrl = (url) => ABSOLUTE_URL_REGEX.test(url);
 function resolvePath(to, fromPathname = "/") {
   let {
@@ -936,7 +966,7 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
   }
   return path;
 }
-var removeDoubleSlashes = (path) => path.replace(/\/\/+/g, "/");
+var removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 var joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
 var removeTrailingSlash = (path) => path.replace(/\/+$/, "");
 var normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
@@ -976,6 +1006,14 @@ var replace = (url, init) => {
   response.headers.set("X-Remix-Replace", "true");
   return response;
 };
+var SUPPORTED_ERROR_TYPES = [
+  "EvalError",
+  "RangeError",
+  "ReferenceError",
+  "SyntaxError",
+  "TypeError",
+  "URIError"
+];
 var ErrorResponseImpl = class {
   constructor(status, statusText, data2, internal = false) {
     this.status = status;
@@ -1011,7 +1049,7 @@ function parseToInfo(_to, basename) {
   if (isBrowser) {
     try {
       let currentUrl = new URL(window.location.href);
-      let targetUrl = to.startsWith("//") ? new URL(currentUrl.protocol + to) : new URL(to);
+      let targetUrl = PROTOCOL_RELATIVE_URL_REGEX.test(to) ? new URL(normalizeProtocolRelativeUrl(to, currentUrl.protocol)) : new URL(to);
       let path = stripBasename(targetUrl.pathname, basename);
       if (targetUrl.origin === currentUrl.origin && path != null) {
         to = path + targetUrl.search + targetUrl.hash;
@@ -5203,11 +5241,20 @@ var invalidProtocols = [
   // eslint-disable-next-line no-script-url
   "javascript:"
 ];
+function hasInvalidProtocol(location) {
+  try {
+    return invalidProtocols.includes(new URL(location).protocol);
+  } catch {
+    return false;
+  }
+}
 function normalizeRedirectLocation(location, currentUrl, basename, historyInstance) {
   if (isAbsoluteUrl(location)) {
     let normalizedLocation = location;
-    let url = normalizedLocation.startsWith("//") ? new URL(currentUrl.protocol + normalizedLocation) : new URL(normalizedLocation);
-    if (invalidProtocols.includes(url.protocol)) {
+    let url = PROTOCOL_RELATIVE_URL_REGEX.test(normalizedLocation) ? new URL(
+      normalizeProtocolRelativeUrl(normalizedLocation, currentUrl.protocol)
+    ) : new URL(normalizedLocation);
+    if (hasInvalidProtocol(url.toString())) {
       throw new Error("Invalid redirect location");
     }
     let isSameBasename = stripBasename(url.pathname, basename) != null;
@@ -5217,7 +5264,7 @@ function normalizeRedirectLocation(location, currentUrl, basename, historyInstan
   }
   try {
     let url = historyInstance.createURL(location);
-    if (invalidProtocols.includes(url.protocol)) {
+    if (hasInvalidProtocol(url.toString())) {
       throw new Error("Invalid redirect location");
     }
   } catch (e) {
@@ -6146,9 +6193,13 @@ function RSCErrorHandler({
       let existingRedirect = errorRedirectHandledMap.get(error);
       if (existingRedirect) throw existingRedirect;
       let parsed = parseToInfo(redirect2.location, basename);
+      let target = parsed.absoluteURL || parsed.to;
+      if (hasInvalidProtocol(target)) {
+        throw new Error("Invalid redirect location");
+      }
       if (isBrowser && !errorRedirectHandledMap.get(error)) {
         if (parsed.isExternal || redirect2.reloadDocument) {
-          window.location.href = parsed.absoluteURL || parsed.to;
+          window.location.href = target;
         } else {
           const redirectPromise = Promise.resolve().then(
             () => window.__reactRouterDataRouter.navigate(parsed.to, {
@@ -6159,13 +6210,7 @@ function RSCErrorHandler({
           throw redirectPromise;
         }
       }
-      return /* @__PURE__ */ React2.createElement(
-        "meta",
-        {
-          httpEquiv: "refresh",
-          content: `0;url=${parsed.absoluteURL || parsed.to}`
-        }
-      );
+      return /* @__PURE__ */ React2.createElement("meta", { httpEquiv: "refresh", content: `0;url=${target}` });
     }
   }
   return children;
@@ -7417,14 +7462,6 @@ var TYPE_SET = "S";
 var TYPE_SYMBOL = "Y";
 var TYPE_URL = "U";
 var TYPE_PREVIOUS_RESOLVED = "Z";
-var SUPPORTED_ERROR_TYPES = [
-  "EvalError",
-  "RangeError",
-  "ReferenceError",
-  "SyntaxError",
-  "TypeError",
-  "URIError"
-];
 var Deferred2 = class {
   constructor() {
     this.promise = new Promise((resolve, reject) => {
@@ -8901,9 +8938,11 @@ import * as React6 from "react";
 // lib/dom/ssr/fallback.tsx
 import * as React5 from "react";
 function RemixRootDefaultHydrateFallback() {
+  let { nonce } = useFrameworkContext();
   return /* @__PURE__ */ React5.createElement(BoundaryShell, { title: "Loading...", renderScripts: true }, ENABLE_DEV_WARNINGS ? /* @__PURE__ */ React5.createElement(
     "script",
     {
+      nonce,
       dangerouslySetInnerHTML: {
         __html: `
               console.log(
@@ -9323,6 +9362,21 @@ var nextPaths = /* @__PURE__ */ new Set();
 var discoveredPathsMaxSize = 1e3;
 var discoveredPaths = /* @__PURE__ */ new Set();
 var URL_LIMIT = 7680;
+function getPathsWithAncestors(paths) {
+  let result = /* @__PURE__ */ new Set();
+  paths.forEach((path) => {
+    if (!path.startsWith("/")) {
+      path = `/${path}`;
+    }
+    for (let i = 1; i < path.length; i++) {
+      if (path[i] === "/") {
+        result.add(path.slice(0, i));
+      }
+    }
+    result.add(path);
+  });
+  return Array.from(result);
+}
 function isFogOfWarEnabled(routeDiscovery, ssr) {
   return routeDiscovery.mode === "lazy" && ssr === true;
 }
@@ -9444,6 +9498,7 @@ function getManifestPath(_manifestPath, basename) {
 }
 var MANIFEST_VERSION_STORAGE_KEY = "react-router-manifest-version";
 async function fetchAndApplyManifestPatches(paths, errorReloadPath, manifest, routeModules, ssr, isSpaMode, basename, manifestPath, patchRoutes, signal) {
+  paths = getPathsWithAncestors(paths);
   const searchParams = new URLSearchParams();
   searchParams.set("paths", paths.sort().join(","));
   searchParams.set("version", manifest.version);
@@ -9636,13 +9691,22 @@ function getActiveMatches(matches, errors, isSpaMode) {
 }
 var CRITICAL_CSS_DATA_ATTRIBUTE = "data-react-router-critical-css";
 function Links({ nonce, crossOrigin }) {
-  let { isSpaMode, manifest, routeModules, criticalCss } = useFrameworkContext();
+  let {
+    isSpaMode,
+    manifest,
+    routeModules,
+    criticalCss,
+    nonce: contextNonce
+  } = useFrameworkContext();
   let { errors, matches: routerMatches } = useDataRouterStateContext();
   let matches = getActiveMatches(routerMatches, errors, isSpaMode);
   let keyedLinks = React8.useMemo(
     () => getKeyedLinksForMatches(matches, routeModules, manifest),
     [matches, routeModules, manifest]
   );
+  if (nonce == null && contextNonce) {
+    nonce = contextNonce;
+  }
   return /* @__PURE__ */ React8.createElement(React8.Fragment, null, typeof criticalCss === "string" ? /* @__PURE__ */ React8.createElement(
     "style",
     {
@@ -9681,6 +9745,7 @@ function Links({ nonce, crossOrigin }) {
 }
 function PrefetchPageLinks({ page, ...linkProps }) {
   let rsc = useIsRSCRouterContext();
+  let { nonce: contextNonce } = useFrameworkContext();
   let { router } = useDataRouterContext2();
   let matches = React8.useMemo(
     () => matchRoutes(router.routes, page, router.basename),
@@ -9689,6 +9754,9 @@ function PrefetchPageLinks({ page, ...linkProps }) {
   if (!matches) {
     return null;
   }
+  if (linkProps.nonce == null && contextNonce) {
+    linkProps = { ...linkProps, nonce: contextNonce };
+  }
   if (rsc) {
     return /* @__PURE__ */ React8.createElement(RSCPrefetchPageLinksImpl, { page, matches, ...linkProps });
   }
@@ -9962,12 +10030,16 @@ function Scripts(scriptProps) {
     isSpaMode,
     renderMeta,
     routeDiscovery,
-    ssr
+    ssr,
+    nonce: contextNonce
   } = useFrameworkContext();
   let { router, static: isStatic, staticContext } = useDataRouterContext2();
   let { matches: routerMatches } = useDataRouterStateContext();
   let isRSCRouterContext = useIsRSCRouterContext();
   let enableFogOfWar = isFogOfWarEnabled(routeDiscovery, ssr);
+  if (scriptProps.nonce == null && contextNonce) {
+    scriptProps = { ...scriptProps, nonce: contextNonce };
+  }
   if (renderMeta) {
     renderMeta.didRenderScripts = true;
   }
@@ -10163,10 +10235,12 @@ function RemixRootDefaultErrorBoundary({
   error,
   isOutsideRemixApp
 }) {
+  let { nonce } = useFrameworkContext();
   console.error(error);
   let heyDeveloper = /* @__PURE__ */ React9.createElement(
     "script",
     {
+      nonce,
       dangerouslySetInnerHTML: {
         __html: `
         console.log(
@@ -10233,7 +10307,7 @@ var isBrowser2 = typeof window !== "undefined" && typeof window.document !== "un
 try {
   if (isBrowser2) {
     window.__reactRouterVersion = // @ts-expect-error
-    "7.16.0";
+    "7.18.0";
   }
 } catch (e) {
 }
@@ -10292,7 +10366,7 @@ function deserializeErrors(errors) {
         val.internal === true
       );
     } else if (val && val.__type === "Error") {
-      if (val.__subType) {
+      if (typeof val.__subType === "string" && SUPPORTED_ERROR_TYPES.includes(val.__subType)) {
         let ErrorConstructor = window[val.__subType];
         if (typeof ErrorConstructor === "function") {
           try {
@@ -10424,7 +10498,6 @@ function HistoryRouter({
   );
 }
 HistoryRouter.displayName = "unstable_HistoryRouter";
-var ABSOLUTE_URL_REGEX2 = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
 var Link = React10.forwardRef(
   function LinkWithRef({
     onClick,
@@ -10443,7 +10516,7 @@ var Link = React10.forwardRef(
     ...rest
   }, forwardedRef) {
     let { basename, navigator, useTransitions } = React10.useContext(NavigationContext);
-    let isAbsolute = typeof to === "string" && ABSOLUTE_URL_REGEX2.test(to);
+    let isAbsolute = typeof to === "string" && ABSOLUTE_URL_REGEX.test(to);
     let parsed = parseToInfo(to, basename);
     to = parsed.to;
     let href = useHref(to, { relative });
@@ -10590,7 +10663,7 @@ var Form = React10.forwardRef(
     let submit = useSubmit();
     let formAction = useFormAction(action, { relative });
     let formMethod = method.toLowerCase() === "get" ? "get" : "post";
-    let isAbsolute = typeof action === "string" && ABSOLUTE_URL_REGEX2.test(action);
+    let isAbsolute = typeof action === "string" && ABSOLUTE_URL_REGEX.test(action);
     let submitHandler = (event) => {
       onSubmit && onSubmit(event);
       if (event.defaultPrevented) return;
@@ -10672,6 +10745,9 @@ function ScrollRestoration({
       sessionStorage.removeItem(storageKey2);
     }
   }).toString();
+  if (props.nonce == null && remixContext?.nonce) {
+    props.nonce = remixContext.nonce;
+  }
   return /* @__PURE__ */ React10.createElement(
     "script",
     {
@@ -11372,16 +11448,16 @@ function createHref(to) {
 function encodeLocation(to) {
   let href = typeof to === "string" ? to : createPath(to);
   href = href.replace(/ $/, "%20");
-  let encoded = ABSOLUTE_URL_REGEX3.test(href) ? new URL(href) : new URL(href, "http://localhost");
+  let encoded = ABSOLUTE_URL_REGEX.test(href) ? new URL(href) : new URL(href, "http://localhost");
   return {
     pathname: encoded.pathname,
     search: encoded.search,
     hash: encoded.hash
   };
 }
-var ABSOLUTE_URL_REGEX3 = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
 
 export {
+  PROTOCOL_RELATIVE_URL_REGEX,
   Action,
   createMemoryHistory,
   createBrowserHistory,
@@ -11411,7 +11487,7 @@ export {
   createRouter,
   createStaticHandler,
   getStaticContextFromError,
-  invalidProtocols,
+  hasInvalidProtocol,
   isDataWithResponseInit,
   isResponse,
   isRedirectStatusCode,
@@ -11493,6 +11569,7 @@ export {
   createClientRoutes,
   shouldHydrateRouteLoader,
   URL_LIMIT,
+  getPathsWithAncestors,
   getPatchRoutesOnNavigationFunction,
   useFogOFWarDiscovery,
   getManifestPath,