react-router 7.18.2 → 7.18.4

package/dist/development/{chunk-62JRHF6Z.mjs → chunk-OB3PAWPO.mjs}

@@ -1,5 +1,5 @@
 /**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -784,13 +784,16 @@ function matchPathImpl(pattern, pathname, matcher, compiledParams) {
   let match = pathname.match(matcher);
   if (!match) return null;
   let matchedPathname = match[0];
-  let pathnameBase = matchedPathname.replace(/(.)\/+$/, "$1");
+  let pathnameBase = removeTrailingSlash(matchedPathname, 1);
   let captureGroups = match.slice(1);
   let params = compiledParams.reduce(
     (memo2, { paramName, isOptional }, index) => {
       if (paramName === "*") {
         let splatValue = captureGroups[index] || "";
-        pathnameBase = matchedPathname.slice(0, matchedPathname.length - splatValue.length).replace(/(.)\/+$/, "$1");
+        pathnameBase = removeTrailingSlash(
+          matchedPathname.slice(0, matchedPathname.length - splatValue.length),
+          1
+        );
       }
       const value = captureGroups[index];
       if (isOptional && !value) {
@@ -880,7 +883,7 @@ function resolvePath(to, fromPathname = "/") {
   let pathname;
   if (toPathname) {
     toPathname = removeDoubleSlashes(toPathname);
-    if (toPathname.startsWith("/")) {
+    if (toPathname.startsWith("/") || toPathname.startsWith("\\")) {
       pathname = resolvePathname(toPathname.substring(1), "/");
     } else {
       pathname = resolvePathname(toPathname, fromPathname);
@@ -968,7 +971,13 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
 }
 var removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 var joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
-var removeTrailingSlash = (path) => path.replace(/\/+$/, "");
+function removeTrailingSlash(path, minLength = 0) {
+  let end = path.length;
+  while (end > minLength && path.charCodeAt(end - 1) === 47) {
+    end--;
+  }
+  return end === path.length ? path : path.slice(0, end);
+}
 var normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
 var normalizeSearch = (search) => !search || search === "?" ? "" : search.startsWith("?") ? search : "?" + search;
 var normalizeHash = (hash) => !hash || hash === "#" ? "" : hash.startsWith("#") ? hash : "#" + hash;
@@ -1341,6 +1350,51 @@ function isPlainObject(thing) {
   return proto === Object.prototype || proto === null || Object.getOwnPropertyNames(proto).sort().join("\0") === objectProtoNames;
 }
 
+// lib/router/navigation.ts
+var DEFAULT_NAVIGATION_URL = new URL("http://localhost");
+function getNavigatorCurrentUrl(navigator) {
+  if (navigator.createURL) {
+    return navigator.createURL("/");
+  }
+  try {
+    return new URL(navigator.createHref("/"), DEFAULT_NAVIGATION_URL);
+  } catch {
+    return DEFAULT_NAVIGATION_URL;
+  }
+}
+function isSameOrigin(a, b) {
+  return a.origin === b.origin && (a.origin !== "null" || a.protocol === b.protocol && a.host === b.host);
+}
+function isExplicitUrl(destination, target) {
+  if (destination.startsWith("//")) {
+    return true;
+  }
+  let protocol = target.protocol.toLowerCase();
+  if (!destination.toLowerCase().startsWith(protocol)) {
+    return false;
+  }
+  return target.host === "" || destination.slice(protocol.length).startsWith("//");
+}
+function validateNavigationTarget(original, resolved, currentUrl, externalPolicy) {
+  let originalUrl = null;
+  try {
+    originalUrl = original == null ? null : new URL(original, currentUrl);
+  } catch {
+  }
+  let resolvedUrl = new URL(resolved, currentUrl);
+  let originalIsExternal = originalUrl != null && !isSameOrigin(originalUrl, currentUrl);
+  let resolvedIsExternal = !isSameOrigin(resolvedUrl, currentUrl);
+  if (externalPolicy === "reject") {
+    if (originalIsExternal || resolvedIsExternal) {
+      throw new Error("External navigation is not allowed");
+    }
+  } else if (resolvedIsExternal) {
+    if (originalUrl == null || !isExplicitUrl(original, originalUrl) || !isSameOrigin(originalUrl, resolvedUrl)) {
+      throw new Error("External navigation is not allowed");
+    }
+  }
+}
+
 // lib/router/router.ts
 var validMutationMethodsArr = [
   "POST",
@@ -1764,7 +1818,7 @@ function createRouter(init) {
       init.history.replace(location, location.state);
     }
     let viewTransitionOpts;
-    if (pendingAction === "POP" /* Pop */) {
+    if (pendingAction === "POP" /* Pop */ && !isUninterruptedRevalidation && location !== state.location) {
       let priorPaths = appliedViewTransitions.get(state.location.pathname);
       if (priorPaths && priorPaths.has(location.pathname)) {
         viewTransitionOpts = {
@@ -1852,11 +1906,21 @@ function createRouter(init) {
         ...opts.mask
       };
       maskPath = {
-        pathname: "",
-        search: "",
-        hash: "",
-        ...partialPath
+        pathname: partialPath.pathname ?? "",
+        search: partialPath.search ?? "",
+        hash: partialPath.hash ?? ""
       };
+      if (PROTOCOL_RELATIVE_URL_REGEX.test(maskPath.pathname)) {
+        throw new Error("External navigation is not allowed");
+      } else if (maskPath.pathname.startsWith("\\")) {
+        maskPath.pathname = maskPath.pathname.replace(/^\\+/, "/");
+      }
+      validateNavigationTarget(
+        typeof opts.mask === "string" ? opts.mask : createPath(opts.mask),
+        createPath(maskPath),
+        init.history.createURL("/"),
+        "reject"
+      );
     }
     let currentLocation = state.location;
     let nextLocation = createLocation(
@@ -1870,6 +1934,12 @@ function createRouter(init) {
       ...nextLocation,
       ...init.history.encodeLocation(nextLocation)
     };
+    validateNavigationTarget(
+      to == null ? init.history.createHref(state.location) : typeof to === "string" ? to : createPath(to),
+      init.history.createHref(nextLocation.mask || nextLocation),
+      init.history.createURL("/"),
+      "reject"
+    );
     let userReplace = opts && opts.replace != null ? opts.replace : void 0;
     let historyAction = "PUSH" /* Push */;
     if (userReplace === true) {
@@ -2880,12 +2950,20 @@ function createRouter(init) {
     }
     let location = redirect2.response.headers.get("Location");
     invariant(location, "Expected a Location header on the redirect Response");
+    let originalLocation = location;
+    let currentUrl = new URL(request.url);
     location = normalizeRedirectLocation(
       location,
-      new URL(request.url),
+      currentUrl,
       basename,
       init.history
     );
+    validateNavigationTarget(
+      originalLocation,
+      location,
+      currentUrl,
+      "allow-explicit"
+    );
     let redirectLocation = createLocation(state.location, location, {
       _isRedirect: true
     });
@@ -3404,6 +3482,7 @@ function createRouter(init) {
     // Passthrough to history-aware createHref used by useHref so we get proper
     // hash-aware URLs in DOM paths
     createHref: (to) => init.history.createHref(to),
+    createURL: (to) => init.history.createURL(to),
     encodeLocation: (to) => init.history.encodeLocation(to),
     getFetcher,
     resetFetcher,
@@ -5945,6 +6024,12 @@ function useNavigateUnstable() {
       if (dataRouterContext == null && basename !== "/") {
         path.pathname = path.pathname === "/" ? basename : joinPaths([basename, path.pathname]);
       }
+      validateNavigationTarget(
+        typeof to === "string" ? to : createPath(to),
+        navigator.createHref(path),
+        getNavigatorCurrentUrl(navigator),
+        "reject"
+      );
       (!!options.replace ? navigator.replace : navigator.push)(
         path,
         options.state,
@@ -6186,7 +6271,7 @@ function RSCErrorHandler({
   children,
   error
 }) {
-  let { basename } = React2.useContext(NavigationContext);
+  let { basename, navigator } = React2.useContext(NavigationContext);
   if (typeof error === "object" && error && "digest" in error && typeof error.digest === "string") {
     let redirect2 = decodeRedirectErrorDigest(error.digest);
     if (redirect2) {
@@ -6194,6 +6279,12 @@ function RSCErrorHandler({
       if (existingRedirect) throw existingRedirect;
       let parsed = parseToInfo(redirect2.location, basename);
       let target = parsed.absoluteURL || parsed.to;
+      validateNavigationTarget(
+        redirect2.location,
+        target,
+        getNavigatorCurrentUrl(navigator),
+        "allow-explicit"
+      );
       if (hasInvalidProtocol(target)) {
         throw new Error("Invalid redirect location");
       }
@@ -6871,6 +6962,7 @@ function RouterProvider({
   let navigator = React3.useMemo(() => {
     return {
       createHref: router.createHref,
+      createURL: router.createURL,
       encodeLocation: router.encodeLocation,
       go: (n) => router.navigate(n),
       push: (to, state2, opts) => router.navigate(to, {
@@ -7003,7 +7095,7 @@ function Navigate({
     // the router loaded. We can help them understand how to avoid that.
     `<Navigate> may be used only in the context of a <Router> component.`
   );
-  let { static: isStatic } = React3.useContext(NavigationContext);
+  let { static: isStatic, navigator } = React3.useContext(NavigationContext);
   warning(
     !isStatic,
     `<Navigate> must not be used on the initial render in a <StaticRouter>. This is a no-op, but you should modify your code so the <Navigate> is only ever rendered in response to some user interaction or state change.`
@@ -7017,6 +7109,12 @@ function Navigate({
     locationPathname,
     relative === "path"
   );
+  validateNavigationTarget(
+    typeof to === "string" ? to : createPath(to),
+    navigator.createHref(path),
+    getNavigatorCurrentUrl(navigator),
+    "reject"
+  );
   let jsonPath = JSON.stringify(path);
   React3.useEffect(() => {
     navigate(JSON.parse(jsonPath), { replace: replace2, state, relative });
@@ -8172,6 +8270,9 @@ var ESCAPE_REGEX = /[&><\u2028\u2029]/g;
 function escapeHtml(html) {
   return html.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
 }
+function escapeAttribute(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 
 // lib/dom/ssr/invariant.ts
 function invariant2(value, message) {
@@ -10307,7 +10408,7 @@ var isBrowser2 = typeof window !== "undefined" && typeof window.document !== "un
 try {
   if (isBrowser2) {
     window.__reactRouterVersion = // @ts-expect-error
-    "7.18.2";
+    "7.18.4";
   }
 } catch (e) {
 }
@@ -11481,6 +11582,7 @@ export {
   ErrorResponseImpl,
   isRouteErrorResponse,
   instrumentHandler,
+  validateNavigationTarget,
   IDLE_NAVIGATION,
   IDLE_FETCHER,
   IDLE_BLOCKER,
@@ -11551,6 +11653,7 @@ export {
   withErrorBoundaryProps,
   createSearchParams,
   escapeHtml,
+  escapeAttribute,
   encode,
   createRequestInit,
   SingleFetchRedirectSymbol,

package/dist/{production/context-CeD5LmaF.d.mts → development/context-nqAapj74.d.mts}

@@ -207,6 +207,14 @@ interface Router$1 {
      * @param location
      */
     createHref(location: Location | URL): string;
+    /**
+     * @private
+     * PRIVATE - DO NOT USE
+     *
+     * Utility function to create a URL for the given location
+     * @param location
+     */
+    createURL?(to: To): URL;
     /**
      * @private
      * PRIVATE - DO NOT USE
@@ -1751,6 +1759,7 @@ interface NavigateOptions {
  */
 interface Navigator {
     createHref: History["createHref"];
+    createURL?: History["createURL"];
     encodeLocation?: History["encodeLocation"];
     go: History["go"];
     push(to: To, state?: any, opts?: NavigateOptions): void;

package/dist/development/dom-export.d.mts

@@ -1,6 +1,6 @@
 import * as React from 'react';
-import { a as RouterProviderProps$1, R as RouterInit, C as ClientInstrumentation, b as ClientOnErrorFunction } from './context-CeD5LmaF.mjs';
-export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-DBmQ1yAR.mjs';
+import { a as RouterProviderProps$1, R as RouterInit, C as ClientInstrumentation, b as ClientOnErrorFunction } from './context-nqAapj74.mjs';
+export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-BR5QG7ZC.mjs';
 import './data-DEjBmEfD.mjs';
 
 type RouterProviderProps = Omit<RouterProviderProps$1, "flushSync">;

package/dist/development/dom-export.d.ts

@@ -1,7 +1,7 @@
 import * as React from 'react';
 import { RouterProviderProps as RouterProviderProps$1, RouterInit, ClientOnErrorFunction } from 'react-router';
-import { C as ClientInstrumentation } from './instrumentation-Dkmpzd13.js';
-export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-B2PdsXXH.js';
+import { C as ClientInstrumentation } from './instrumentation-B7w3_Eo9.js';
+export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-eq4RgLsD.js';
 import './data-CjO11-hU.js';
 
 type RouterProviderProps = Omit<RouterProviderProps$1, "flushSync">;

package/dist/development/dom-export.js

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }/**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -13,7 +13,7 @@
 
 
 
-var _chunk3UVS743Kjs = require('./chunk-3UVS743K.js');
+var _chunkLVPI3KDGjs = require('./chunk-LVPI3KDG.js');
 
 
 
@@ -37,7 +37,8 @@ var _chunk3UVS743Kjs = require('./chunk-3UVS743K.js');
 
 
 
-var _chunkHHGH3NKSjs = require('./chunk-HHGH3NKS.js');
+
+var _chunkGR4NQCSDjs = require('./chunk-GR4NQCSD.js');
 
 // lib/dom-export/dom-router-provider.tsx
 var _react = require('react'); var React = _interopRequireWildcard(_react); var React2 = _interopRequireWildcard(_react); var React3 = _interopRequireWildcard(_react);
@@ -213,7 +214,7 @@ function HydratedRouter(props) {
   }, []);
   React2.useEffect(() => {
     if (process.env.NODE_ENV === "development" && criticalCss === void 0) {
-      document.querySelectorAll(`[${_chunkHHGH3NKSjs.CRITICAL_CSS_DATA_ATTRIBUTE}]`).forEach((element) => element.remove());
+      document.querySelectorAll(`[${_chunkGR4NQCSDjs.CRITICAL_CSS_DATA_ATTRIBUTE}]`).forEach((element) => element.remove());
     }
   }, [criticalCss]);
   let [location2, setLocation] = React2.useState(router.state.location);
@@ -307,8 +308,14 @@ function createCallServer({
         Promise.resolve(payloadPromise).then(async (payload) => {
           if (payload.type === "redirect") {
             let location2 = normalizeRedirectLocation(payload.location);
+            _chunkGR4NQCSDjs.validateNavigationTarget.call(void 0, 
+              payload.location,
+              location2,
+              new URL(window.location.href),
+              "allow-explicit"
+            );
             if (payload.reload || isExternalLocation(location2)) {
-              if (_chunkHHGH3NKSjs.hasInvalidProtocol.call(void 0, location2)) {
+              if (_chunkGR4NQCSDjs.hasInvalidProtocol.call(void 0, location2)) {
                 throw new Error("Invalid redirect location");
               }
               window.location.href = location2;
@@ -328,8 +335,14 @@ function createCallServer({
           if (rerender && landedActionId < actionId && globalVar.__routerActionID <= actionId) {
             if (rerender.type === "redirect") {
               let location2 = normalizeRedirectLocation(rerender.location);
+              _chunkGR4NQCSDjs.validateNavigationTarget.call(void 0, 
+                rerender.location,
+                location2,
+                new URL(window.location.href),
+                "allow-explicit"
+              );
               if (rerender.reload || isExternalLocation(location2)) {
-                if (_chunkHHGH3NKSjs.hasInvalidProtocol.call(void 0, location2)) {
+                if (_chunkGR4NQCSDjs.hasInvalidProtocol.call(void 0, location2)) {
                   throw new Error("Invalid redirect location");
                 }
                 window.location.href = location2;
@@ -394,7 +407,7 @@ function createRouterFromPayload({
     };
   if (payload.type !== "render") throw new Error("Invalid payload type");
   globalVar.__reactRouterRouteModules = _nullishCoalesce(globalVar.__reactRouterRouteModules, () => ( {}));
-  _chunk3UVS743Kjs.populateRSCRouteModules.call(void 0, globalVar.__reactRouterRouteModules, payload.matches);
+  _chunkLVPI3KDGjs.populateRSCRouteModules.call(void 0, globalVar.__reactRouterRouteModules, payload.matches);
   let routes = payload.matches.reduceRight((previous, match) => {
     const route = createRouteFromServerManifest(
       match,
@@ -408,12 +421,12 @@ function createRouterFromPayload({
     return [route];
   }, []);
   let applyPatchesPromise;
-  globalVar.__reactRouterDataRouter = _chunkHHGH3NKSjs.createRouter.call(void 0, {
+  globalVar.__reactRouterDataRouter = _chunkGR4NQCSDjs.createRouter.call(void 0, {
     routes,
     getContext,
     basename: payload.basename,
-    history: _chunkHHGH3NKSjs.createBrowserHistory.call(void 0, ),
-    hydrationData: _chunk3UVS743Kjs.getHydrationData.call(void 0, {
+    history: _chunkGR4NQCSDjs.createBrowserHistory.call(void 0, ),
+    hydrationData: _chunkLVPI3KDGjs.getHydrationData.call(void 0, {
       state: {
         loaderData: payload.loaderData,
         actionData: payload.actionData,
@@ -422,7 +435,7 @@ function createRouterFromPayload({
       routes,
       getRouteInfo: (routeId) => {
         let match = payload.matches.find((m) => m.id === routeId);
-        _chunkHHGH3NKSjs.invariant.call(void 0, match, "Route not found in payload");
+        _chunkGR4NQCSDjs.invariant.call(void 0, match, "Route not found in payload");
         return {
           clientLoader: match.clientLoader,
           hasLoader: match.hasLoader,
@@ -537,9 +550,9 @@ function createRouterFromPayload({
     routeModules: globalVar.__reactRouterRouteModules
   };
 }
-var renderedRoutesContext = _chunkHHGH3NKSjs.createContext.call(void 0, );
+var renderedRoutesContext = _chunkGR4NQCSDjs.createContext.call(void 0, );
 function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReadableStream, fetchImplementation) {
-  let dataStrategy = _chunkHHGH3NKSjs.getSingleFetchDataStrategyImpl.call(void 0, 
+  let dataStrategy = _chunkGR4NQCSDjs.getSingleFetchDataStrategyImpl.call(void 0, 
     getRouter,
     (match) => {
       let M = match;
@@ -596,20 +609,20 @@ function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReada
 function getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation) {
   return async (args, basename, trailingSlashAware, targetRoutes) => {
     let { request, context } = args;
-    let url = _chunkHHGH3NKSjs.singleFetchUrl.call(void 0, request.url, basename, trailingSlashAware, "rsc");
+    let url = _chunkGR4NQCSDjs.singleFetchUrl.call(void 0, request.url, basename, trailingSlashAware, "rsc");
     if (request.method === "GET") {
-      url = _chunkHHGH3NKSjs.stripIndexParam.call(void 0, url);
+      url = _chunkGR4NQCSDjs.stripIndexParam.call(void 0, url);
       if (targetRoutes) {
         url.searchParams.set("_routes", targetRoutes.join(","));
       }
     }
     let res = await fetchImplementation(
-      new Request(url, await _chunkHHGH3NKSjs.createRequestInit.call(void 0, request))
+      new Request(url, await _chunkGR4NQCSDjs.createRequestInit.call(void 0, request))
     );
     if (res.status >= 400 && !res.headers.has("X-Remix-Response")) {
-      throw new (0, _chunkHHGH3NKSjs.ErrorResponseImpl)(res.status, res.statusText, await res.text());
+      throw new (0, _chunkGR4NQCSDjs.ErrorResponseImpl)(res.status, res.statusText, await res.text());
     }
-    _chunkHHGH3NKSjs.invariant.call(void 0, res.body, "No response body to decode");
+    _chunkGR4NQCSDjs.invariant.call(void 0, res.body, "No response body to decode");
     try {
       const payload = await createFromReadableStream(res.body, {
         temporaryReferences: void 0
@@ -633,7 +646,7 @@ function getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation)
       }
       context.get(renderedRoutesContext).push(...payload.matches);
       let results = { routes: {} };
-      const dataKey = _chunkHHGH3NKSjs.isMutationMethod.call(void 0, request.method) ? "actionData" : "loaderData";
+      const dataKey = _chunkGR4NQCSDjs.isMutationMethod.call(void 0, request.method) ? "actionData" : "loaderData";
       for (let [routeId, data] of Object.entries(payload[dataKey] || {})) {
         results.routes[routeId] = { data };
       }
@@ -666,7 +679,7 @@ function RSCHydratedRouter({
     [createFromReadableStream, payload, fetchImplementation, getContext]
   );
   React3.useEffect(() => {
-    _chunkHHGH3NKSjs.setIsHydrated.call(void 0, );
+    _chunkGR4NQCSDjs.setIsHydrated.call(void 0, );
   }, []);
   React3.useLayoutEffect(() => {
     const globalVar = window;
@@ -774,8 +787,8 @@ function RSCHydratedRouter({
     },
     routeModules
   };
-  return /* @__PURE__ */ React3.createElement(_chunkHHGH3NKSjs.RSCRouterContext.Provider, { value: true }, /* @__PURE__ */ React3.createElement(_chunk3UVS743Kjs.RSCRouterGlobalErrorBoundary, { location: state.location }, /* @__PURE__ */ React3.createElement(_chunkHHGH3NKSjs.FrameworkContext.Provider, { value: frameworkContext }, /* @__PURE__ */ React3.createElement(
-    _chunkHHGH3NKSjs.RouterProvider,
+  return /* @__PURE__ */ React3.createElement(_chunkGR4NQCSDjs.RSCRouterContext.Provider, { value: true }, /* @__PURE__ */ React3.createElement(_chunkLVPI3KDGjs.RSCRouterGlobalErrorBoundary, { location: state.location }, /* @__PURE__ */ React3.createElement(_chunkGR4NQCSDjs.FrameworkContext.Provider, { value: frameworkContext }, /* @__PURE__ */ React3.createElement(
+    _chunkGR4NQCSDjs.RouterProvider,
     {
       router: transitionEnabledRouter,
       flushSync: ReactDOM2.flushSync
@@ -791,8 +804,8 @@ function createRouteFromServerManifest(match, payload) {
   // the server loader flow regardless of whether the client loader calls
   // `serverLoader` or not, otherwise we'll have nothing to render.
   match.hasComponent && !match.element;
-  _chunkHHGH3NKSjs.invariant.call(void 0, window.__reactRouterRouteModules);
-  _chunk3UVS743Kjs.populateRSCRouteModules.call(void 0, window.__reactRouterRouteModules, match);
+  _chunkGR4NQCSDjs.invariant.call(void 0, window.__reactRouterRouteModules);
+  _chunkLVPI3KDGjs.populateRSCRouteModules.call(void 0, window.__reactRouterRouteModules, match);
   let dataRoute = {
     id: match.id,
     element: match.element,
@@ -840,7 +853,7 @@ function createRouteFromServerManifest(match, payload) {
         return await callSingleFetch(singleFetch);
       }
     }) : match.hasAction ? (_, singleFetch) => callSingleFetch(singleFetch) : () => {
-      throw _chunkHHGH3NKSjs.noActionDefinedError.call(void 0, "action", match.id);
+      throw _chunkGR4NQCSDjs.noActionDefinedError.call(void 0, "action", match.id);
     },
     path: match.path,
     shouldRevalidate: match.shouldRevalidate,
@@ -852,7 +865,7 @@ function createRouteFromServerManifest(match, payload) {
     hasClientAction: match.clientAction != null
   };
   if (typeof dataRoute.loader === "function") {
-    dataRoute.loader.hydrate = _chunkHHGH3NKSjs.shouldHydrateRouteLoader.call(void 0, 
+    dataRoute.loader.hydrate = _chunkGR4NQCSDjs.shouldHydrateRouteLoader.call(void 0, 
       match.id,
       match.clientLoader,
       match.hasLoader,
@@ -862,7 +875,7 @@ function createRouteFromServerManifest(match, payload) {
   return dataRoute;
 }
 function callSingleFetch(singleFetch) {
-  _chunkHHGH3NKSjs.invariant.call(void 0, typeof singleFetch === "function", "Invalid singleFetch parameter");
+  _chunkGR4NQCSDjs.invariant.call(void 0, typeof singleFetch === "function", "Invalid singleFetch parameter");
   return singleFetch();
 }
 function preventInvalidServerHandlerCall(type, routeId, hasHandler) {
@@ -870,7 +883,7 @@ function preventInvalidServerHandlerCall(type, routeId, hasHandler) {
     let fn = type === "action" ? "serverAction()" : "serverLoader()";
     let msg = `You are trying to call ${fn} on a route that does not have a server ${type} (routeId: "${routeId}")`;
     console.error(msg);
-    throw new (0, _chunkHHGH3NKSjs.ErrorResponseImpl)(400, "Bad Request", new Error(msg), true);
+    throw new (0, _chunkGR4NQCSDjs.ErrorResponseImpl)(400, "Bad Request", new Error(msg), true);
   }
 }
 var nextPaths = /* @__PURE__ */ new Set();
@@ -893,12 +906,12 @@ function getManifestUrl(paths) {
   return url;
 }
 async function fetchAndApplyManifestPatches(paths, createFromReadableStream, fetchImplementation, signal) {
-  paths = _chunkHHGH3NKSjs.getPathsWithAncestors.call(void 0, paths);
+  paths = _chunkGR4NQCSDjs.getPathsWithAncestors.call(void 0, paths);
   let url = getManifestUrl(paths);
   if (url == null) {
     return;
   }
-  if (url.toString().length > _chunkHHGH3NKSjs.URL_LIMIT) {
+  if (url.toString().length > _chunkGR4NQCSDjs.URL_LIMIT) {
     nextPaths.clear();
     return;
   }
@@ -942,8 +955,8 @@ function isExternalLocation(location2) {
   return newLocation.origin !== window.location.origin;
 }
 function normalizeRedirectLocation(location2) {
-  if (_chunkHHGH3NKSjs.PROTOCOL_RELATIVE_URL_REGEX.test(location2)) {
-    let path = _chunkHHGH3NKSjs.resolvePath.call(void 0, location2);
+  if (_chunkGR4NQCSDjs.PROTOCOL_RELATIVE_URL_REGEX.test(location2)) {
+    let path = _chunkGR4NQCSDjs.resolvePath.call(void 0, location2);
     return path.pathname + path.search + path.hash;
   }
   return location2;

package/dist/development/dom-export.mjs

@@ -1,5 +1,5 @@
 /**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -13,7 +13,7 @@ import {
   RSCRouterGlobalErrorBoundary,
   getHydrationData,
   populateRSCRouteModules
-} from "./chunk-ZA36QIGN.mjs";
+} from "./chunk-H4DAEOV7.mjs";
 import {
   CRITICAL_CSS_DATA_ATTRIBUTE,
   ErrorResponseImpl,
@@ -45,8 +45,9 @@ import {
   shouldHydrateRouteLoader,
   singleFetchUrl,
   stripIndexParam,
-  useFogOFWarDiscovery
-} from "./chunk-62JRHF6Z.mjs";
+  useFogOFWarDiscovery,
+  validateNavigationTarget
+} from "./chunk-OB3PAWPO.mjs";
 
 // lib/dom-export/dom-router-provider.tsx
 import * as React from "react";
@@ -299,6 +300,12 @@ function createCallServer({
         Promise.resolve(payloadPromise).then(async (payload) => {
           if (payload.type === "redirect") {
             let location2 = normalizeRedirectLocation(payload.location);
+            validateNavigationTarget(
+              payload.location,
+              location2,
+              new URL(window.location.href),
+              "allow-explicit"
+            );
             if (payload.reload || isExternalLocation(location2)) {
               if (hasInvalidProtocol(location2)) {
                 throw new Error("Invalid redirect location");
@@ -320,6 +327,12 @@ function createCallServer({
           if (rerender && landedActionId < actionId && globalVar.__routerActionID <= actionId) {
             if (rerender.type === "redirect") {
               let location2 = normalizeRedirectLocation(rerender.location);
+              validateNavigationTarget(
+                rerender.location,
+                location2,
+                new URL(window.location.href),
+                "allow-explicit"
+              );
               if (rerender.reload || isExternalLocation(location2)) {
                 if (hasInvalidProtocol(location2)) {
                   throw new Error("Invalid redirect location");

package/dist/{production/index-react-server-client-3ykjivgQ.d.ts → development/index-react-server-client-BjY-eKuf.d.ts}

@@ -1,4 +1,4 @@
-import { l as ServerInstrumentation, H as HydrationState, e as StaticHandlerContext, c as RelativeRoutingType, a as Router$1, g as RouterState, R as RouterInit, t as FutureConfig$1, C as ClientInstrumentation, d as GetScrollRestorationKeyFunction, F as Fetcher, B as BlockerFunction, u as CreateStaticHandlerOptions$1, S as StaticHandler } from './instrumentation-Dkmpzd13.js';
+import { l as ServerInstrumentation, H as HydrationState, e as StaticHandlerContext, c as RelativeRoutingType, a as Router$1, g as RouterState, R as RouterInit, t as FutureConfig$1, C as ClientInstrumentation, d as GetScrollRestorationKeyFunction, F as Fetcher, B as BlockerFunction, u as CreateStaticHandlerOptions$1, S as StaticHandler } from './instrumentation-B7w3_Eo9.js';
 import * as React from 'react';
 import { p as RouteManifest, aE as ServerRouteModule, t as MiddlewareEnabled, c as RouterContextProvider, u as AppLoadContext, s as LoaderFunctionArgs, a0 as ActionFunctionArgs, O as RouteModules, n as DataRouteObject, a as ClientLoaderFunction, o as RouteBranch, aF as TrackedPromise, f as History, T as To, L as Location, i as Action, ac as RouteMatch, Y as InitialEntry, _ as NonIndexRouteObject, a7 as LazyRouteFunction, Z as IndexRouteObject, P as Params, l as DataStrategyFunction, m as PatchRoutesOnNavigationFunction, e as RouteObject, U as UIMatch, q as HTMLFormMethod, F as FormEncType, av as PageLinkDescriptor, Q as SerializeFrom } from './data-CjO11-hU.js';
 
@@ -197,6 +197,7 @@ interface NavigateOptions {
  */
 interface Navigator {
     createHref: History["createHref"];
+    createURL?: History["createURL"];
     encodeLocation?: History["encodeLocation"];
     go: History["go"];
     push(to: To, state?: any, opts?: NavigateOptions): void;

package/dist/{production/index-react-server-client-CACgcj2J.d.mts → development/index-react-server-client-K63fpMH4.d.mts}

@@ -1,4 +1,4 @@
-import { o as ServerInstrumentation, H as HydrationState, h as StaticHandlerContext, f as RelativeRoutingType, g as GetScrollRestorationKeyFunction, R as RouterInit, ah as FutureConfig$1, C as ClientInstrumentation, N as NavigateOptions, F as Fetcher, c as Router, B as BlockerFunction, ai as CreateStaticHandlerOptions$1, S as StaticHandler } from './context-CeD5LmaF.mjs';
+import { o as ServerInstrumentation, H as HydrationState, h as StaticHandlerContext, f as RelativeRoutingType, g as GetScrollRestorationKeyFunction, R as RouterInit, ah as FutureConfig$1, C as ClientInstrumentation, N as NavigateOptions, F as Fetcher, c as Router, B as BlockerFunction, ai as CreateStaticHandlerOptions$1, S as StaticHandler } from './context-nqAapj74.mjs';
 import * as React from 'react';
 import { J as RouteManifest, aF as ServerRouteModule, p as MiddlewareEnabled, c as RouterContextProvider, q as AppLoadContext, o as LoaderFunctionArgs, a3 as ActionFunctionArgs, Z as RouteModules, E as DataRouteObject, a as ClientLoaderFunction, I as RouteBranch, m as HTMLFormMethod, n as FormEncType, aw as PageLinkDescriptor, T as To, s as History, z as DataStrategyFunction, B as PatchRoutesOnNavigationFunction, r as RouteObject, _ as SerializeFrom, L as Location } from './data-DEjBmEfD.mjs';
 

package/dist/development/index-react-server-client.d.mts

@@ -1,4 +1,4 @@
-export { Q as MemoryRouter, T as Navigate, U as Outlet, V as Route, W as Router, X as RouterProvider, Y as Routes, A as UNSAFE_AwaitContextProvider, ab as UNSAFE_WithComponentProps, af as UNSAFE_WithErrorBoundaryProps, ad as UNSAFE_WithHydrateFallbackProps } from './context-CeD5LmaF.mjs';
-export { l as BrowserRouter, q as Form, m as HashRouter, n as Link, X as Links, W as Meta, p as NavLink, r as ScrollRestoration, T as StaticRouter, V as StaticRouterProvider, o as unstable_HistoryRouter } from './index-react-server-client-CACgcj2J.mjs';
+export { Q as MemoryRouter, T as Navigate, U as Outlet, V as Route, W as Router, X as RouterProvider, Y as Routes, A as UNSAFE_AwaitContextProvider, ab as UNSAFE_WithComponentProps, af as UNSAFE_WithErrorBoundaryProps, ad as UNSAFE_WithHydrateFallbackProps } from './context-nqAapj74.mjs';
+export { l as BrowserRouter, q as Form, m as HashRouter, n as Link, X as Links, W as Meta, p as NavLink, r as ScrollRestoration, T as StaticRouter, V as StaticRouterProvider, o as unstable_HistoryRouter } from './index-react-server-client-K63fpMH4.mjs';
 import './data-DEjBmEfD.mjs';
 import 'react';

package/dist/development/index-react-server-client.d.ts

@@ -1,4 +1,4 @@
-export { W as BrowserRouter, $ as Form, X as HashRouter, Y as Link, an as Links, j as MemoryRouter, am as Meta, _ as NavLink, k as Navigate, l as Outlet, m as Route, n as Router, o as RouterProvider, p as Routes, a0 as ScrollRestoration, ak as StaticRouter, al as StaticRouterProvider, b as UNSAFE_AwaitContextProvider, aH as UNSAFE_WithComponentProps, aL as UNSAFE_WithErrorBoundaryProps, aJ as UNSAFE_WithHydrateFallbackProps, Z as unstable_HistoryRouter } from './index-react-server-client-3ykjivgQ.js';
-import './instrumentation-Dkmpzd13.js';
+export { W as BrowserRouter, $ as Form, X as HashRouter, Y as Link, an as Links, j as MemoryRouter, am as Meta, _ as NavLink, k as Navigate, l as Outlet, m as Route, n as Router, o as RouterProvider, p as Routes, a0 as ScrollRestoration, ak as StaticRouter, al as StaticRouterProvider, b as UNSAFE_AwaitContextProvider, aH as UNSAFE_WithComponentProps, aL as UNSAFE_WithErrorBoundaryProps, aJ as UNSAFE_WithHydrateFallbackProps, Z as unstable_HistoryRouter } from './index-react-server-client-BjY-eKuf.js';
+import './instrumentation-B7w3_Eo9.js';
 import './data-CjO11-hU.js';
 import 'react';