react-router 7.17.0 → 7.18.0

package/dist/production/index-react-server.d.mts

@@ -845,6 +845,8 @@ interface RouteMeta<RouteObjectType extends RouteObject = RouteObject> {
     caseSensitive: boolean;
     childrenIndex: number;
     route: RouteObjectType;
+    matcher?: RegExp;
+    compiledParams?: CompiledPathParam[];
 }
 /**
  * @private
@@ -858,6 +860,10 @@ interface RouteBranch<RouteObjectType extends RouteObject = RouteObject> {
     score: number;
     routesMeta: RouteMeta<RouteObjectType>[];
 }
+type CompiledPathParam = {
+    paramName: string;
+    isOptional?: boolean;
+};
 declare class DataWithResponseInit<D> {
     type: string;
     data: D;
@@ -1837,7 +1843,9 @@ interface PageLinkDescriptor extends Omit<HtmlLinkDescriptor, "href" | "rel" | "
     /**
      * A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
      * attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
-     * element
+     * element. If not provided in Framework Mode, it will default to any
+     * {@link ServerRouter | `<ServerRouter nonce>`} prop.
+  
      */
     nonce?: string | undefined;
     /**

package/dist/production/index-react-server.d.ts

@@ -845,6 +845,8 @@ interface RouteMeta<RouteObjectType extends RouteObject = RouteObject> {
     caseSensitive: boolean;
     childrenIndex: number;
     route: RouteObjectType;
+    matcher?: RegExp;
+    compiledParams?: CompiledPathParam[];
 }
 /**
  * @private
@@ -858,6 +860,10 @@ interface RouteBranch<RouteObjectType extends RouteObject = RouteObject> {
     score: number;
     routesMeta: RouteMeta<RouteObjectType>[];
 }
+type CompiledPathParam = {
+    paramName: string;
+    isOptional?: boolean;
+};
 declare class DataWithResponseInit<D> {
     type: string;
     data: D;
@@ -1837,7 +1843,9 @@ interface PageLinkDescriptor extends Omit<HtmlLinkDescriptor, "href" | "rel" | "
     /**
      * A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
      * attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
-     * element
+     * element. If not provided in Framework Mode, it will default to any
+     * {@link ServerRouter | `<ServerRouter nonce>`} prop.
+  
      */
     nonce?: string | undefined;
     /**

package/dist/production/index-react-server.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var node_async_hooks = require('node:async_hooks');
-var React2 = require('react');
+var React3 = require('react');
 var setCookieParser = require('set-cookie-parser');
 var reactServerClient = require('react-router/internal/react-server-client');
 var cookie = require('cookie');
@@ -24,10 +24,10 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var React2__namespace = /*#__PURE__*/_interopNamespace(React2);
+var React3__namespace = /*#__PURE__*/_interopNamespace(React3);
 
 /**
- * react-router v7.17.0
+ * react-router v7.18.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -43,6 +43,9 @@ var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot
 var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
 var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 
+// lib/router/url.ts
+var ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|[\\/]{2})/i;
+
 // lib/router/history.ts
 function invariant(value, message) {
   if (value === false || value === null || typeof value === "undefined") {
@@ -502,7 +505,18 @@ function flattenRoutes(routes, branches = [], parentsMeta = [], parentPath = "",
     branches.push({
       path,
       score: computeScore(path, route.index),
-      routesMeta
+      routesMeta: routesMeta.map((meta2, i) => {
+        let [matcher, params] = compilePath(
+          meta2.relativePath,
+          meta2.caseSensitive,
+          i === routesMeta.length - 1
+        );
+        return {
+          ...meta2,
+          matcher,
+          compiledParams: params
+        };
+      })
     });
   };
   routes.forEach((route, index) => {
@@ -591,9 +605,19 @@ function matchRouteBranch(branch, pathname, allowPartial = false) {
     let meta = routesMeta[i];
     let end = i === routesMeta.length - 1;
     let remainingPathname = matchedPathname === "/" ? pathname : pathname.slice(matchedPathname.length) || "/";
-    let match = matchPath(
-      { path: meta.relativePath, caseSensitive: meta.caseSensitive, end },
-      remainingPathname
+    let pattern = {
+      path: meta.relativePath,
+      caseSensitive: meta.caseSensitive,
+      end
+    };
+    let match = (
+      // Use precomputed matcher if it exists
+      meta.matcher && meta.compiledParams ? matchPathImpl(
+        pattern,
+        remainingPathname,
+        meta.matcher,
+        meta.compiledParams
+      ) : matchPath(pattern, remainingPathname)
     );
     let route = meta.route;
     if (!match && end && allowPartial && !routesMeta[routesMeta.length - 1].route.index) {
@@ -634,6 +658,9 @@ function matchPath(pattern, pathname) {
     pattern.caseSensitive,
     pattern.end
   );
+  return matchPathImpl(pattern, pathname, matcher, compiledParams);
+}
+function matchPathImpl(pattern, pathname, matcher, compiledParams) {
   let match = pathname.match(matcher);
   if (!match) return null;
   let matchedPathname = match[0];
@@ -722,7 +749,6 @@ function prependBasename({
 }) {
   return pathname === "/" ? basename : joinPaths([basename, pathname]);
 }
-var ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
 var isAbsoluteUrl = (url) => ABSOLUTE_URL_REGEX.test(url);
 function resolvePath(to, fromPathname = "/") {
   let {
@@ -819,7 +845,7 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
   }
   return path;
 }
-var removeDoubleSlashes = (path) => path.replace(/\/\/+/g, "/");
+var removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 var joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
 var removeTrailingSlash = (path) => path.replace(/\/+$/, "");
 var normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
@@ -2469,9 +2495,71 @@ function prependCookies(parentHeaders, childHeaders) {
 }
 var SINGLE_FETCH_REDIRECT_STATUS = 202;
 
+// lib/server-runtime/warnings.ts
+var alreadyWarned = {};
+function warnOnce(condition, message) {
+  if (!condition && !alreadyWarned[message]) {
+    alreadyWarned[message] = true;
+    console.warn(message);
+  }
+}
+
+// lib/errors.ts
+var ERROR_DIGEST_BASE = "REACT_ROUTER_ERROR";
+var ERROR_DIGEST_REDIRECT = "REDIRECT";
+var ERROR_DIGEST_ROUTE_ERROR_RESPONSE = "ROUTE_ERROR_RESPONSE";
+function createRedirectErrorDigest(response) {
+  return `${ERROR_DIGEST_BASE}:${ERROR_DIGEST_REDIRECT}:${JSON.stringify({
+    status: response.status,
+    statusText: response.statusText,
+    location: response.headers.get("Location"),
+    reloadDocument: response.headers.get("X-Remix-Reload-Document") === "true",
+    replace: response.headers.get("X-Remix-Replace") === "true"
+  })}`;
+}
+function createRouteErrorResponseDigest(response) {
+  let status = 500;
+  let statusText = "";
+  let data2;
+  if (isDataWithResponseInit(response)) {
+    status = response.init?.status ?? status;
+    statusText = response.init?.statusText ?? statusText;
+    data2 = response.data;
+  } else {
+    status = response.status;
+    statusText = response.statusText;
+    data2 = void 0;
+  }
+  return `${ERROR_DIGEST_BASE}:${ERROR_DIGEST_ROUTE_ERROR_RESPONSE}:${JSON.stringify(
+    {
+      status,
+      statusText,
+      data: data2
+    }
+  )}`;
+}
+
+// lib/dom/ssr/fog-of-war.ts
+var URL_LIMIT = 7680;
+function getPathsWithAncestors(paths) {
+  let result = /* @__PURE__ */ new Set();
+  paths.forEach((path) => {
+    if (!path.startsWith("/")) {
+      path = `/${path}`;
+    }
+    for (let i = 1; i < path.length; i++) {
+      if (path[i] === "/") {
+        result.add(path.slice(0, i));
+      }
+    }
+    result.add(path);
+  });
+  return Array.from(result);
+}
+
 // lib/actions.ts
-function throwIfPotentialCSRFAttack(headers, allowedActionOrigins) {
-  let originHeader = headers.get("origin");
+function throwIfPotentialCSRFAttack(request, allowedActionOrigins) {
+  let originHeader = request.headers.get("origin");
   let originDomain = null;
   try {
     originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
@@ -2480,18 +2568,12 @@ function throwIfPotentialCSRFAttack(headers, allowedActionOrigins) {
       `\`origin\` header is not a valid URL. Aborting the action.`
     );
   }
-  let host = parseHostHeader(headers);
-  if (originDomain && (!host || originDomain !== host.value)) {
+  let host = new URL(request.url).host;
+  if (originDomain && originDomain !== host) {
     if (!isAllowedOrigin(originDomain, allowedActionOrigins)) {
-      if (host) {
-        throw new Error(
-          `${host.type} header does not match \`origin\` header from a forwarded action request. Aborting the action.`
-        );
-      } else {
-        throw new Error(
-          "`x-forwarded-host` or `host` headers are not provided. One of these is needed to compare the `origin` header from a forwarded action request. Aborting the action."
-        );
-      }
+      throw new Error(
+        "The `request.url` host does not match `origin` header from a forwarded action request. Aborting the action."
+      );
     }
   }
 }
@@ -2539,53 +2621,6 @@ function isAllowedOrigin(originDomain, allowedActionOrigins = []) {
     (allowedOrigin) => allowedOrigin && (allowedOrigin === originDomain || matchWildcardDomain(originDomain, allowedOrigin))
   );
 }
-function parseHostHeader(headers) {
-  let forwardedHostHeader = headers.get("x-forwarded-host");
-  let forwardedHostValue = forwardedHostHeader?.split(",")[0]?.trim();
-  let hostHeader = headers.get("host");
-  return forwardedHostValue ? {
-    type: "x-forwarded-host",
-    value: forwardedHostValue
-  } : hostHeader ? {
-    type: "host",
-    value: hostHeader
-  } : void 0;
-}
-
-// lib/errors.ts
-var ERROR_DIGEST_BASE = "REACT_ROUTER_ERROR";
-var ERROR_DIGEST_REDIRECT = "REDIRECT";
-var ERROR_DIGEST_ROUTE_ERROR_RESPONSE = "ROUTE_ERROR_RESPONSE";
-function createRedirectErrorDigest(response) {
-  return `${ERROR_DIGEST_BASE}:${ERROR_DIGEST_REDIRECT}:${JSON.stringify({
-    status: response.status,
-    statusText: response.statusText,
-    location: response.headers.get("Location"),
-    reloadDocument: response.headers.get("X-Remix-Reload-Document") === "true",
-    replace: response.headers.get("X-Remix-Replace") === "true"
-  })}`;
-}
-function createRouteErrorResponseDigest(response) {
-  let status = 500;
-  let statusText = "";
-  let data2;
-  if (isDataWithResponseInit(response)) {
-    status = response.init?.status ?? status;
-    statusText = response.init?.statusText ?? statusText;
-    data2 = response.data;
-  } else {
-    status = response.status;
-    statusText = response.statusText;
-    data2 = void 0;
-  }
-  return `${ERROR_DIGEST_BASE}:${ERROR_DIGEST_ROUTE_ERROR_RESPONSE}:${JSON.stringify(
-    {
-      status,
-      statusText,
-      data: data2
-    }
-  )}`;
-}
 
 // lib/server-runtime/urls.ts
 function getNormalizedPath(request, basename, future) {
@@ -2657,7 +2692,7 @@ var replace2 = (...args) => {
 };
 var cachedResolvePromise = (
   // @ts-expect-error - on 18 types, requires 19.
-  React2__namespace.cache(async (resolve) => {
+  React3__namespace.cache(async (resolve) => {
     return Promise.allSettled([resolve]).then((r) => r[0]);
   })
 );
@@ -2672,13 +2707,13 @@ var Await = async ({
     throw resolved.reason;
   }
   if (resolved.status === "rejected") {
-    return React2__namespace.createElement(reactServerClient.UNSAFE_AwaitContextProvider, {
-      children: React2__namespace.createElement(React2__namespace.Fragment, null, errorElement),
+    return React3__namespace.createElement(reactServerClient.UNSAFE_AwaitContextProvider, {
+      children: React3__namespace.createElement(React3__namespace.Fragment, null, errorElement),
       value: { _tracked: true, _error: resolved.reason }
     });
   }
   const toRender = typeof children === "function" ? children(resolved.value) : children;
-  return React2__namespace.createElement(reactServerClient.UNSAFE_AwaitContextProvider, {
+  return React3__namespace.createElement(reactServerClient.UNSAFE_AwaitContextProvider, {
     children: toRender,
     value: { _tracked: true, _data: resolved.value }
   });
@@ -2767,6 +2802,13 @@ async function matchRSCServerRequest({
   return response;
 }
 async function generateManifestResponse(routes, basename, request, generateResponse, temporaryReferences, routeDiscovery) {
+  let url = new URL(request.url);
+  if (url.toString().length > URL_LIMIT) {
+    return new Response(null, {
+      statusText: "Bad Request",
+      status: 400
+    });
+  }
   if (routeDiscovery?.mode === "initial") {
     let payload2 = {
       type: "manifest",
@@ -2784,7 +2826,6 @@ async function generateManifestResponse(routes, basename, request, generateRespo
       { temporaryReferences, onError: defaultOnError }
     );
   }
-  let url = new URL(request.url);
   let pathParam = url.searchParams.get("paths");
   let pathnames = pathParam ? pathParam.split(",").filter(Boolean) : [url.pathname.replace(/\.manifest$/, "")];
   let routeIds = /* @__PURE__ */ new Set();
@@ -2987,7 +3028,7 @@ async function generateRenderResponse(request, routes, basename, isDataRequest,
         let potentialCSRFAttackError;
         if (isMutationMethod(request.method)) {
           try {
-            throwIfPotentialCSRFAttack(request.headers, allowedActionOrigins);
+            throwIfPotentialCSRFAttack(request, allowedActionOrigins);
             ctx.runningAction = true;
             let result2 = await processServerAction(
               request,
@@ -3215,7 +3256,7 @@ async function getRenderPayload(baseRenderPayload, routes, basename, routeIdsToL
       (patch) => !staticContext.matches.some((m) => m.route.id === patch.id)
     )
   ) : getAdditionalRoutePatches(
-    [staticContext.location.pathname],
+    getPathsWithAncestors([staticContext.location.pathname]),
     routes,
     basename,
     staticContext.matches.map((m) => m.route.id)
@@ -3235,7 +3276,7 @@ async function getRSCRouteMatch({
 }) {
   const route = match.route;
   await explodeLazyRoute(route);
-  const Layout = route.Layout || React2__namespace.Fragment;
+  const Layout = route.Layout || React3__namespace.Fragment;
   const Component = route.Component;
   const ErrorBoundary = route.ErrorBoundary;
   const HydrateFallback = route.HydrateFallback;
@@ -3245,12 +3286,12 @@ async function getRSCRouteMatch({
   let element = void 0;
   let shouldLoadRoute = !routeIdsToLoad || routeIdsToLoad.includes(route.id);
   if (Component && shouldLoadRoute) {
-    element = !isBelowErrorBoundary ? React2__namespace.createElement(
+    element = !isBelowErrorBoundary ? React3__namespace.createElement(
       Layout,
       null,
-      isClientReference(Component) ? React2__namespace.createElement(WithComponentProps, {
-        children: React2__namespace.createElement(Component)
-      }) : React2__namespace.createElement(Component, {
+      isClientReference(Component) ? React3__namespace.createElement(WithComponentProps, {
+        children: React3__namespace.createElement(Component)
+      }) : React3__namespace.createElement(Component, {
         loaderData,
         actionData,
         params,
@@ -3258,30 +3299,30 @@ async function getRSCRouteMatch({
           (match2) => convertRouteMatchToUiMatch(match2, staticContext.loaderData)
         )
       })
-    ) : React2__namespace.createElement(Outlet);
+    ) : React3__namespace.createElement(Outlet);
   }
   let error = void 0;
   if (ErrorBoundary && staticContext.errors) {
     error = staticContext.errors[route.id];
   }
-  const errorElement = ErrorBoundary ? React2__namespace.createElement(
+  const errorElement = ErrorBoundary ? React3__namespace.createElement(
     Layout,
     null,
-    isClientReference(ErrorBoundary) ? React2__namespace.createElement(WithErrorBoundaryProps, {
-      children: React2__namespace.createElement(ErrorBoundary)
-    }) : React2__namespace.createElement(ErrorBoundary, {
+    isClientReference(ErrorBoundary) ? React3__namespace.createElement(WithErrorBoundaryProps, {
+      children: React3__namespace.createElement(ErrorBoundary)
+    }) : React3__namespace.createElement(ErrorBoundary, {
       loaderData,
       actionData,
       params,
       error
     })
   ) : void 0;
-  const hydrateFallbackElement = HydrateFallback ? React2__namespace.createElement(
+  const hydrateFallbackElement = HydrateFallback ? React3__namespace.createElement(
     Layout,
     null,
-    isClientReference(HydrateFallback) ? React2__namespace.createElement(WithHydrateFallbackProps, {
-      children: React2__namespace.createElement(HydrateFallback)
-    }) : React2__namespace.createElement(HydrateFallback, {
+    isClientReference(HydrateFallback) ? React3__namespace.createElement(WithHydrateFallbackProps, {
+      children: React3__namespace.createElement(HydrateFallback)
+    }) : React3__namespace.createElement(HydrateFallback, {
       loaderData,
       actionData,
       params
@@ -3318,11 +3359,11 @@ async function getRSCRouteMatch({
 }
 async function getManifestRoute(route) {
   await explodeLazyRoute(route);
-  const Layout = route.Layout || React2__namespace.Fragment;
-  const errorElement = route.ErrorBoundary ? React2__namespace.createElement(
+  const Layout = route.Layout || React3__namespace.Fragment;
+  const errorElement = route.ErrorBoundary ? React3__namespace.createElement(
     Layout,
     null,
-    React2__namespace.createElement(route.ErrorBoundary)
+    React3__namespace.createElement(route.ErrorBoundary)
   ) : void 0;
   return {
     clientAction: route.clientAction,
@@ -3380,27 +3421,18 @@ async function getAdditionalRoutePatches(pathnames, routes, basename, matchedRou
   let patchRouteMatches = /* @__PURE__ */ new Map();
   let matchedPaths = /* @__PURE__ */ new Set();
   for (const pathname of pathnames) {
-    let segments = pathname.split("/").filter(Boolean);
-    let paths = ["/"];
-    segments.pop();
-    while (segments.length > 0) {
-      paths.push(`/${segments.join("/")}`);
-      segments.pop();
-    }
-    paths.forEach((path) => {
-      if (matchedPaths.has(path)) {
+    if (matchedPaths.has(pathname)) {
+      continue;
+    }
+    matchedPaths.add(pathname);
+    let matches = matchRoutes(routes, pathname, basename) || [];
+    matches.forEach((m, i) => {
+      if (patchRouteMatches.get(m.route.id)) {
         return;
       }
-      matchedPaths.add(path);
-      let matches = matchRoutes(routes, path, basename) || [];
-      matches.forEach((m, i) => {
-        if (patchRouteMatches.get(m.route.id)) {
-          return;
-        }
-        patchRouteMatches.set(m.route.id, {
-          ...m.route,
-          parentId: matches[i - 1]?.route.id
-        });
+      patchRouteMatches.set(m.route.id, {
+        ...m.route,
+        parentId: matches[i - 1]?.route.id
       });
     });
   }
@@ -3512,15 +3544,6 @@ function byteStringToUint8Array(byteString) {
   return array;
 }
 
-// lib/server-runtime/warnings.ts
-var alreadyWarned = {};
-function warnOnce(condition, message) {
-  if (!condition && !alreadyWarned[message]) {
-    alreadyWarned[message] = true;
-    console.warn(message);
-  }
-}
-
 // lib/server-runtime/cookies.ts
 var createCookie = (name, cookieOptions = {}) => {
   let { secrets = [], ...options } = {