react-router 8.3.0 → 8.3.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # `react-router`
 
+## v8.3.1
+
+### Patch Changes
+
+- Fix `Expected fetcher: <key>` error thrown on navigation when a fetcher is aborted during its post-action revalidation ([#15365](https://github.com/remix-run/react-router/pull/15365))
+- Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit ([#15399](https://github.com/remix-run/react-router/pull/15399))
+- Improve route matching performance for long paths ([#15417](https://github.com/remix-run/react-router/pull/15417))
+- Improve validation of action request origins ([#15419](https://github.com/remix-run/react-router/pull/15419))
+- Fix `<ScrollRestoration>` leaving `history.scrollRestoration` set to `"auto"` after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered ([#15397](https://github.com/remix-run/react-router/pull/15397))
+- Properly respect the `relative` option in `useSubmit`/`fetcher.submit` when resolivng the `action` path ([#15400](https://github.com/remix-run/react-router/pull/15400))
+- Add additional URL validation on client side navigations/redirects ([#15445](https://github.com/remix-run/react-router/pull/15445))
+
 ## v8.3.0
 
 ### Patch Changes
@@ -17,7 +29,7 @@
 
 ### Unstable Changes
 
-⚠️  _[Unstable features](https://reactrouter.com/community/api-development-strategy#unstable-flags) are not recommended for production use_
+⚠️ _[Unstable features](https://reactrouter.com/community/api-development-strategy#unstable-flags) are not recommended for production use_
 
 - Detect stale RSC clients during lazy route discovery and reload the destination document ([#15318](https://github.com/remix-run/react-router/pull/15318))
 
@@ -35,7 +47,6 @@
   ```
 
 - Add CSP nonce support to RSC document rendering ([#15320](https://github.com/remix-run/react-router/pull/15320))
-
   - Add `nonce` options to `unstable_routeRSCServerRequest` and `unstable_RSCStaticRouter`
   - Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components
 

package/dist/development/dom-export.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/index-react-server-client.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/index-react-server.d.ts

@@ -1231,6 +1231,14 @@ interface Router$1 {
    * @param location
    */
   createHref(location: Location | URL): string;
+  /**
+   * @private
+   * PRIVATE - DO NOT USE
+   *
+   * Utility function to create a URL for the given location
+   * @param location
+   */
+  createURL?(to: To): URL;
   /**
    * @private
    * PRIVATE - DO NOT USE

package/dist/development/index-react-server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -24,7 +24,7 @@ function warning(cond, message) {
 		if (typeof console !== "undefined") console.warn(message);
 		try {
 			throw new Error(message);
-		} catch (e) {}
+		} catch {}
 	}
 }
 function createKey$1() {
@@ -515,13 +515,13 @@ function matchPathImpl(pattern, pathname, matcher, compiledParams) {
 	let match = pathname.match(matcher);
 	if (!match) return null;
 	let matchedPathname = match[0];
-	let pathnameBase = matchedPathname.replace(/(.)\/+$/, "$1");
+	let pathnameBase = removeTrailingSlash(matchedPathname, 1);
 	let captureGroups = match.slice(1);
 	return {
 		params: compiledParams.reduce((memo, { paramName, isOptional }, index) => {
 			if (paramName === "*") {
 				let splatValue = captureGroups[index] || "";
-				pathnameBase = matchedPathname.slice(0, matchedPathname.length - splatValue.length).replace(/(.)\/+$/, "$1");
+				pathnameBase = removeTrailingSlash(matchedPathname.slice(0, matchedPathname.length - splatValue.length), 1);
 			}
 			const value = captureGroups[index];
 			if (isOptional && !value) memo[paramName] = void 0;
@@ -590,7 +590,7 @@ function resolvePath(to, fromPathname = "/") {
 	let pathname;
 	if (toPathname) {
 		toPathname = removeDoubleSlashes(toPathname);
-		if (toPathname.startsWith("/")) pathname = resolvePathname(toPathname.substring(1), "/");
+		if (toPathname.startsWith("/") || toPathname.startsWith("\\")) pathname = resolvePathname(toPathname.substring(1), "/");
 		else pathname = resolvePathname(toPathname, fromPathname);
 	} else pathname = fromPathname;
 	return {
@@ -651,7 +651,11 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
 }
 const removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 const joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
-const removeTrailingSlash = (path) => path.replace(/\/+$/, "");
+function removeTrailingSlash(path, minLength = 0) {
+	let end = path.length;
+	while (end > minLength && path.charCodeAt(end - 1) === 47) end--;
+	return end === path.length ? path : path.slice(0, end);
+}
 const normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
 const normalizeSearch = (search) => !search || search === "?" ? "" : search.startsWith("?") ? search : "?" + search;
 const normalizeHash = (hash) => !hash || hash === "#" ? "" : hash.startsWith("#") ? hash : "#" + hash;
@@ -1816,7 +1820,7 @@ async function callDataStrategyImpl(dataStrategyImpl, request, path, matches, fe
 	});
 	try {
 		await Promise.all(matches.flatMap((m) => [m._lazyPromises?.handler, m._lazyPromises?.route]));
-	} catch (e) {}
+	} catch {}
 	return results;
 }
 async function callLoaderOrAction({ request, path, pattern, match, lazyHandlerPromise, lazyRoutePromise, handlerOverride, scopedContext }) {
@@ -2217,14 +2221,19 @@ function getPathsWithAncestors(paths) {
 function throwIfPotentialCSRFAttack(request, allowedActionOrigins) {
 	let originHeader = request.headers.get("origin");
 	let originDomain = null;
+	let originUrl = null;
 	try {
-		originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+		if (typeof originHeader === "string" && originHeader !== "null") {
+			originUrl = new URL(originHeader);
+			originDomain = originUrl.host;
+		} else originDomain = originHeader;
 	} catch {
 		throw new Error(`\`origin\` header is not a valid URL. Aborting the action.`);
 	}
-	let host = new URL(request.url).host;
-	if (originDomain && originDomain !== host) {
-		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` host does not match `origin` header from a forwarded action request. Aborting the action.");
+	let requestUrl = new URL(request.url);
+	let originMatchesRequest = originUrl ? originUrl.origin === requestUrl.origin : originDomain === requestUrl.host;
+	if (originDomain && !originMatchesRequest) {
+		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` origin does not match `origin` header from a forwarded action request. Aborting the action.");
 	}
 }
 function matchWildcardDomain(domain, pattern) {
@@ -2948,7 +2957,7 @@ const unsign = async (cookie, secret) => {
 	try {
 		let signature = byteStringToUint8Array(atob(hash));
 		return await crypto.subtle.verify("HMAC", key, signature, data) ? value : false;
-	} catch (e) {
+	} catch {
 		return false;
 	}
 };
@@ -3046,7 +3055,7 @@ function encodeData(value) {
 function decodeData(value) {
 	try {
 		return JSON.parse(decodeURIComponent(myEscape(atob(value))));
-	} catch (e) {
+	} catch {
 		return {};
 	}
 }

package/dist/development/index.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/actions.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -12,14 +12,19 @@
 function throwIfPotentialCSRFAttack(request, allowedActionOrigins) {
 	let originHeader = request.headers.get("origin");
 	let originDomain = null;
+	let originUrl = null;
 	try {
-		originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+		if (typeof originHeader === "string" && originHeader !== "null") {
+			originUrl = new URL(originHeader);
+			originDomain = originUrl.host;
+		} else originDomain = originHeader;
 	} catch {
 		throw new Error(`\`origin\` header is not a valid URL. Aborting the action.`);
 	}
-	let host = new URL(request.url).host;
-	if (originDomain && originDomain !== host) {
-		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` host does not match `origin` header from a forwarded action request. Aborting the action.");
+	let requestUrl = new URL(request.url);
+	let originMatchesRequest = originUrl ? originUrl.origin === requestUrl.origin : originDomain === requestUrl.host;
+	if (originDomain && !originMatchesRequest) {
+		if (!isAllowedOrigin(originDomain, allowedActionOrigins)) throw new Error("The `request.url` origin does not match `origin` header from a forwarded action request. Aborting the action.");
 	}
 }
 function matchWildcardDomain(domain, pattern) {

package/dist/development/lib/components.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -8,8 +8,9 @@
  *
  * @license MIT
  */
-import { createMemoryHistory, invariant, parsePath, warning } from "./router/history.js";
+import { createMemoryHistory, createPath, invariant, parsePath, warning } from "./router/history.js";
 import { defaultMapRouteProperties, getResolveToMatches, getRoutePattern, resolveTo, stripBasename } from "./router/utils.js";
+import { getNavigatorCurrentUrl, validateNavigationTarget } from "./router/navigation.js";
 import { createRouter } from "./router/router.js";
 import { AwaitContext, DataRouterContext, DataRouterStateContext, FetchersContext, LocationContext, NavigationContext, RouteContext, ViewTransitionContext, useIsRSCRouterContext } from "./context.js";
 import { _renderMatches, useActionData, useAsyncValue, useInRouterContext, useLoaderData, useLocation, useMatches, useNavigate, useOutlet, useParams, useRouteError, useRoutes, useRoutesImpl } from "./hooks.js";
@@ -256,6 +257,7 @@ function RouterProvider({ router, flushSync: reactDomFlushSyncImpl, onError, use
 	let navigator = React$1.useMemo(() => {
 		return {
 			createHref: router.createHref,
+			createURL: router.createURL,
 			encodeLocation: router.encodeLocation,
 			go: (n) => router.navigate(n),
 			push: (to, state, opts) => router.navigate(to, {
@@ -379,12 +381,13 @@ function MemoryRouter({ basename, children, initialEntries, initialIndex, useTra
 */
 function Navigate({ to, replace, state, relative }) {
 	invariant(useInRouterContext(), `<Navigate> may be used only in the context of a <Router> component.`);
-	let { static: isStatic } = React$1.useContext(NavigationContext);
+	let { static: isStatic, navigator } = React$1.useContext(NavigationContext);
 	warning(!isStatic, "<Navigate> must not be used on the initial render in a <StaticRouter>. This is a no-op, but you should modify your code so the <Navigate> is only ever rendered in response to some user interaction or state change.");
 	let { matches } = React$1.useContext(RouteContext);
 	let { pathname: locationPathname } = useLocation();
 	let navigate = useNavigate();
 	let path = resolveTo(to, getResolveToMatches(matches), locationPathname, relative === "path");
+	validateNavigationTarget(typeof to === "string" ? to : createPath(to), navigator.createHref(path), getNavigatorCurrentUrl(navigator), "reject");
 	let jsonPath = JSON.stringify(path);
 	React$1.useEffect(() => {
 		navigate(JSON.parse(jsonPath), {

package/dist/development/lib/context.d.ts

@@ -55,6 +55,7 @@ interface NavigateOptions {
  */
 interface Navigator {
   createHref: History["createHref"];
+  createURL?: History["createURL"];
   encodeLocation?: History["encodeLocation"];
   go: History["go"];
   push(to: To, state?: any, opts?: NavigateOptions): void;

package/dist/development/lib/context.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/dom.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -75,7 +75,7 @@ function isFormDataSubmitterSupported() {
 	if (_formDataSupportsSubmitter === null) try {
 		new FormData(document.createElement("form"), 0);
 		_formDataSupportsSubmitter = false;
-	} catch (e) {
+	} catch {
 		_formDataSupportsSubmitter = true;
 	}
 	return _formDataSupportsSubmitter;

package/dist/development/lib/dom/lib.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -22,8 +22,8 @@ import * as React$1 from "react";
 //#region lib/dom/lib.tsx
 const isBrowser = typeof window !== "undefined" && typeof window.document !== "undefined" && typeof window.document.createElement !== "undefined";
 try {
-	if (isBrowser) window.__reactRouterVersion = "8.3.0";
-} catch (e) {}
+	if (isBrowser) window.__reactRouterVersion = "8";
+} catch {}
 /**
 * Create a new {@link DataRouter| data router} that manages the application
 * path via [`history.pushState`](https://developer.mozilla.org/en-US/docs/Web/API/History/pushState)
@@ -123,7 +123,7 @@ function deserializeErrors(errors) {
 				let error = new ErrorConstructor(val.message);
 				error.stack = "";
 				serialized[key] = error;
-			} catch (e) {}
+			} catch {}
 		}
 		if (serialized[key] == null) {
 			let error = new Error(val.message);
@@ -796,6 +796,7 @@ function useSubmit() {
 		if (options.navigate === false) await routerFetch(options.fetcherKey || getUniqueFetcherId(), currentRouteId, options.action || action, {
 			defaultShouldRevalidate: options.defaultShouldRevalidate,
 			preventScrollReset: options.preventScrollReset,
+			relative: options.relative,
 			formData,
 			body,
 			formMethod: options.method || method,
@@ -805,6 +806,7 @@ function useSubmit() {
 		else await routerNavigate(options.action || action, {
 			defaultShouldRevalidate: options.defaultShouldRevalidate,
 			preventScrollReset: options.preventScrollReset,
+			relative: options.relative,
 			formData,
 			body,
 			formMethod: options.method || method,
@@ -1087,6 +1089,9 @@ function useScrollRestoration({ getKey, storageKey } = {}) {
 			window.history.scrollRestoration = "auto";
 		};
 	}, []);
+	usePageShow(React$1.useCallback((event) => {
+		if (event.persisted) window.history.scrollRestoration = "manual";
+	}, []));
 	usePageHide(React$1.useCallback(() => {
 		if (navigation.state === "idle") {
 			let key = getScrollRestorationKey(location, matches, basename, getKey);
@@ -1111,7 +1116,7 @@ function useScrollRestoration({ getKey, storageKey } = {}) {
 			try {
 				let sessionPositions = sessionStorage.getItem(storageKey || SCROLL_RESTORATION_STORAGE_KEY);
 				if (sessionPositions) savedScrollPositions = JSON.parse(sessionPositions);
-			} catch (e) {}
+			} catch {}
 		}, [storageKey]);
 		React$1.useLayoutEffect(() => {
 			let disableScrollRestoration = router?.enableScrollRestoration(savedScrollPositions, () => window.scrollY, getKey ? (location, matches) => getScrollRestorationKey(location, matches, basename, getKey) : void 0);
@@ -1179,6 +1184,16 @@ function usePageHide(callback, options) {
 		};
 	}, [callback, capture]);
 }
+function usePageShow(callback, options) {
+	let { capture } = options || {};
+	React$1.useEffect(() => {
+		let opts = capture != null ? { capture } : void 0;
+		window.addEventListener("pageshow", callback, opts);
+		return () => {
+			window.removeEventListener("pageshow", callback, opts);
+		};
+	}, [callback, capture]);
+}
 /**
 * Wrapper around {@link useBlocker} to show a [`window.confirm`](https://developer.mozilla.org/en-US/docs/Web/API/Window/confirm)
 * prompt to users instead of building a custom UI with {@link useBlocker}.

package/dist/development/lib/dom/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/components.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -425,7 +425,7 @@ function Meta() {
 				type: "application/ld+json",
 				dangerouslySetInnerHTML: { __html: escapeHtml(json) }
 			});
-		} catch (e) {
+		} catch {
 			return null;
 		}
 		return /* @__PURE__ */ React$1.createElement("meta", {

package/dist/development/lib/dom/ssr/data.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/errorBoundaries.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/fallback.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/fog-of-war.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -154,6 +154,7 @@ async function fetchAndApplyManifestPatches(paths, errorReloadPath, manifest, ro
 		if (signal?.aborted) return;
 		throw e;
 	}
+	if (signal?.aborted) return;
 	let knownRoutes = new Set(Object.keys(manifest.routes));
 	let patches = Object.values(serverPatches).reduce((acc, route) => {
 		if (route && !knownRoutes.has(route.id)) acc[route.id] = route;

package/dist/development/lib/dom/ssr/hydration.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/invariant.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/links.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/markup.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/routeModules.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/routes-test-stub.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/routes.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom/ssr/single-fetch.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -205,7 +205,7 @@ async function bubbleMiddlewareErrors(singleFetchPromise, matches, routesParams,
 		if (middlewareError !== void 0) Array.from(routesParams.values()).forEach((routeId) => {
 			if (results[routeId].result instanceof SingleFetchNoResultError) results[routeId].result = middlewareError;
 		});
-	} catch (e) {}
+	} catch {}
 }
 async function singleFetchLoaderFetcherStrategy(args, fetchAndDecode) {
 	let fetcherMatch = args.matches.find((m) => m.shouldCallHandler());
@@ -277,7 +277,7 @@ async function fetchAndDecodeViaTurboStream(args, targetRoutes) {
 			status: res.status,
 			data
 		};
-	} catch (e) {
+	} catch {
 		throw new Error("Unable to decode turbo-stream response");
 	}
 }
@@ -326,13 +326,13 @@ function createDeferred() {
 			res(val);
 			try {
 				await promise;
-			} catch (e) {}
+			} catch {}
 		};
 		reject = async (error) => {
 			rej(error);
 			try {
 				await promise;
-			} catch (e) {}
+			} catch {}
 		};
 	});
 	return {

package/dist/development/lib/dom-export/dom-router-provider.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/dom-export/hydrated-router.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/errors.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/hooks.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -8,8 +8,9 @@
  *
  * @license MIT
  */
-import { invariant, parsePath, warning } from "./router/history.js";
+import { createPath, invariant, parsePath, warning } from "./router/history.js";
 import { convertRouteMatchToUiMatch, decodePath, getResolveToMatches, getRoutePattern, isBrowser, isRouteErrorResponse, joinPaths, matchPath, matchRoutes, parseToInfo, resolveTo, stripBasename } from "./router/utils.js";
+import { getNavigatorCurrentUrl, validateNavigationTarget } from "./router/navigation.js";
 import { IDLE_BLOCKER, hasInvalidProtocol } from "./router/router.js";
 import { AwaitContext, DataRouterContext, DataRouterStateContext, LocationContext, NavigationContext, RSCRouterContext, RouteContext, RouteErrorContext } from "./context.js";
 import { decodeRedirectErrorDigest, decodeRouteErrorResponseDigest } from "./errors.js";
@@ -291,6 +292,7 @@ function useNavigateUnstable() {
 		}
 		let path = resolveTo(to, JSON.parse(routePathnamesJson), locationPathname, options.relative === "path");
 		if (dataRouterContext == null && basename !== "/") path.pathname = path.pathname === "/" ? basename : joinPaths([basename, path.pathname]);
+		validateNavigationTarget(typeof to === "string" ? to : createPath(to), navigator.createHref(path), getNavigatorCurrentUrl(navigator), "reject");
 		(!!options.replace ? navigator.replace : navigator.push)(path, options.state, options);
 	}, [
 		basename,
@@ -687,7 +689,7 @@ var RenderErrorBoundary = class extends React$1.Component {
 };
 const errorRedirectHandledMap = /* @__PURE__ */ new WeakMap();
 function RSCErrorHandler({ children, error }) {
-	let { basename } = React$1.useContext(NavigationContext);
+	let { basename, navigator } = React$1.useContext(NavigationContext);
 	if (typeof error === "object" && error && "digest" in error && typeof error.digest === "string") {
 		let redirect = decodeRedirectErrorDigest(error.digest);
 		if (redirect) {
@@ -695,6 +697,7 @@ function RSCErrorHandler({ children, error }) {
 			if (existingRedirect) throw existingRedirect;
 			let parsed = parseToInfo(redirect.location, basename);
 			let target = parsed.absoluteURL || parsed.to;
+			validateNavigationTarget(redirect.location, target, getNavigatorCurrentUrl(navigator), "allow-explicit");
 			if (hasInvalidProtocol(target)) throw new Error("Invalid redirect location");
 			if (isBrowser && !errorRedirectHandledMap.get(error)) if (parsed.isExternal || redirect.reloadDocument) window.location.href = target;
 			else {

package/dist/development/lib/href.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/router/history.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -193,7 +193,7 @@ function warning(cond, message) {
 		if (typeof console !== "undefined") console.warn(message);
 		try {
 			throw new Error(message);
-		} catch (e) {}
+		} catch {}
 	}
 }
 function createKey() {

package/dist/development/lib/router/instrumentation.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *