v8.3.0

Compare Source

Minor Changes

• Restart react-router dev with --conditions=development when not already configured (#​15291)

Patch Changes

• Allow typescript@7 to be used (#​15317)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Add unstable_rsc/client-version client build version virtual module (#​15318)

• Support the subResourceIntegrity config option in RSC Framework Mode (#​15321)

Migration guide

No changes are required when using the default RSC SSR entry. If you maintain a custom app/entry.ssr.tsx, import the new virtual module and pass its hashes to React's importMap render option:

+import subResourceIntegrity from "virtual:react-router/unstable_rsc/subresource-integrity";

return renderToReadableStream(<RSCStaticRouter getPayload={getPayload} />, {
  ...options,
  bootstrapScriptContent,
  formState,
+ importMap: subResourceIntegrity
+   ? { integrity: subResourceIntegrity }
+   : undefined,
  signal: request.signal,
});

• Updated dependencies:
  • react-router@8.3.0
  • @react-router/node@8.3.0
  • @react-router/serve@8.3.0

v8.3.0

Compare Source

Patch Changes

• Allow typescript@7 to be used (#​15317)
• Updated dependencies:
  • react-router@8.3.0

v8.3.0

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@8.3.0
  • @react-router/express@8.3.0
  • @react-router/node@8.3.0

v15.19.0

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-19-0

v8.3.0

Compare Source

Patch Changes

• Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#​15310)
  • Characters that are valid literally in a path segment ($ & + , ; = : @​ — RFC 3986 pchar) are no longer percent-encoded, so values like a semver build 1.0.0+1 interpolate unchanged instead of becoming 1.0.0%2B1
  • Structural/unsafe characters (/ ? # %, whitespace, non-ASCII) are still escaped exactly as before
• Use crypto.randomUUID() for createMemorySessionStorage session ids (#​15302)
  • createMemorySessionStorage is only intended for local development and testing - sessions are lost when the server restarts
• Fix NavLink not applying its pending state when to has a trailing slash (#​15300)
• Preserve RSC route component metadata so routes with a clientLoader can skip unnecessary server requests once their components have rendered while still fetching missing server-rendered elements (#​15323)
• Harden RSC CSRF code paths (#​15311)
• Fix server crash (TypeError: Invalid state: Unable to enqueue) when a request is aborted while the RSC HTML stream has a pending flush (#​15286)
  • Handle cancellation of the injectRSCPayload readable side, clear the pending flush, and cancel the underlying RSC payload stream

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Detect stale RSC clients during lazy route discovery and reload the destination document (#​15318)

Migration

Apps using the default RSC Framework entry do not need to make any changes. Apps with a custom entry.rsc.tsx should import the generated client version and pass it to unstable_matchRSCServerRequest:

import clientVersion from "virtual:react-router/unstable_rsc/client-version";

return unstable_matchRSCServerRequest({
  // ...
  clientVersion,
});

• Add CSP nonce support to RSC document rendering (#​15320)

  • Add nonce options to unstable_routeRSCServerRequest and unstable_RSCStaticRouter
  • Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components

  To adopt nonce-based CSP, update your entry.ssr.tsx (run react-router reveal entry.ssr first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to routeRSCServerRequest, spread the renderHTML options into React's HTML renderer, pass options.nonce to RSCStaticRouter, and use the same nonce in the Content-Security-Policy response header:

  const nonce = crypto.randomUUID();
  const response = await routeRSCServerRequest({
    request,
    serverResponse,
    createFromReadableStream,
    nonce,
    async renderHTML(getPayload, options) {
      const payload = getPayload();
      return renderHTMLToReadableStream(
        <RSCStaticRouter getPayload={getPayload} nonce={options.nonce} />,
        {
          ...options,
          bootstrapScriptContent,
          formState: await payload.formState,
          signal: request.signal,
        },
      );
    },
  });
  response.headers.set(
    "Content-Security-Policy",
    `script-src 'self' 'nonce-${nonce}'`,
  );

v8.65.0

Compare Source

🚀 Features

• add warning when TS 7 is detected (#​12529)

❤️ Thank You

• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.