Update react-router monorepo to v7.12.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@react-router/dev (source)	7.9.3 → 7.12.0
@react-router/serve (source)	7.9.3 → 7.12.0

---

Release Notes

remix-run/react-router (@​react-router/dev)

v7.12.0

Compare Source

Minor Changes

• Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the react-router.config.ts config allowedActionOrigins field. (#​14708)

Patch Changes

• Fix Maximum call stack size exceeded errors when HMR is triggered against code with cyclic imports (#​14522)

• fix(vite): Skip SSR middleware in preview server for SPA mode (#​14673)

• [UNSTABLE] Add a new future.unstable_trailingSlashAwareDataRequests flag to provide consistent behavior of request.pathname inside middleware, loader, and action functions on document and data requests when a trailing slash is present in the browser URL. (#​14644)

  Currently, your HTTP and request pathnames would be as follows for /a/b/c and /a/b/c/

  URL /a/b/c	HTTP pathname	request pathname`
  Document	/a/b/c	/a/b/c ✅
  Data	/a/b/c.data	/a/b/c ✅

  URL /a/b/c/	HTTP pathname	request pathname`
  Document	/a/b/c/	/a/b/c/ ✅
  Data	/a/b/c.data	/a/b/c ⚠️

  With this flag enabled, these pathnames will be made consistent though a new _.data format for client-side .data requests:

  URL /a/b/c	HTTP pathname	request pathname`
  Document	/a/b/c	/a/b/c ✅
  Data	/a/b/c.data	/a/b/c ✅

  URL /a/b/c/	HTTP pathname	request pathname`
  Document	/a/b/c/	/a/b/c/ ✅
  Data	/a/b/c/_.data ⬅️	/a/b/c/ ✅

  This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.

  Enabling this flag also changes the format of client side .data requests from /_root.data to /_.data when navigating to / to align with the new format. This does not impact the request pathname which is still / in all cases.

• Updated dependencies:

  • react-router@7.12.0
  • @react-router/node@7.12.0
  • @react-router/serve@7.12.0

v7.11.0

Compare Source

Minor Changes

• feat: add vite preview support (#​14507)

Patch Changes

• rsc framework mode manual chunking for react and react-router deps (#​14655)
• add support for throwing redirect Response's at RSC render time (#​14596)
• support custom entrypoints for RSC framework mode (#​14643)
• routeRSCServerRequest replace fetchServer with serverResponse (#​14597)
• rsc framewlrk mode - optimize react-server-dom-webpack if in project package.json (#​14656)
• Updated dependencies:
  • react-router@7.11.0
  • @react-router/serve@7.11.0
  • @react-router/node@7.11.0

v7.10.1

Compare Source

Patch Changes

• Import ESM package pkg-types with a dynamic import() to fix issues on Node 20.18 (#​14624)
• Update valibot dependency to ^1.2.0 to address GHSA-vqpr-j7v3-hqw9 (#​14608)
• Updated dependencies:
  • react-router@7.10.1
  • @react-router/node@7.10.1
  • @react-router/serve@7.10.1

v7.10.0

Compare Source

Minor Changes

• Stabilize future.v8_splitRouteModules, replacing future.unstable_splitRouteModules (#​14595)

  • ⚠️ This is a breaking change if you have begun using future.unstable_splitRouteModules. Please update your react-router.config.ts.

• Stabilize future.v8_viteEnvironmentApi, replacing future.unstable_viteEnvironmentApi (#​14595)

  • ⚠️ This is a breaking change if you have begun using future.unstable_viteEnvironmentApi. Please update your react-router.config.ts.

Patch Changes

• Load environment variables before evaluating routes.ts (#​14446)

  For example, you can now compute your routes based on VITE_-prefixed environment variables:

  # .env
  VITE_ENV_ROUTE=my-route

  // app/routes.ts
  import { type RouteConfig, route } from "@​react-router/dev/routes";
  
  const routes: RouteConfig = [];
  if (import.meta.env.VITE_ENV_ROUTE === "my-route") {
    routes.push(route("my-route", "routes/my-route.tsx"));
  }
  
  export default routes;

• Updated dependencies:

  • react-router@7.10.0
  • @react-router/node@7.10.0
  • @react-router/serve@7.10.0

v7.9.6

Compare Source

Patch Changes

• Use a dynamic import() to load ESM-only p-map dependency to avoid issues on Node 20.18 and below (#​14492)
• Short circuit HEAD document requests before calling renderToPipeableStream in the default entry.server.tsx to more closely align with the spec (#​14488)
• Updated dependencies:
  • react-router@7.9.6
  • @react-router/node@7.9.6
  • @react-router/serve@7.9.6

v7.9.5

Compare Source

Patch Changes

• Introduce a prerender.unstable_concurrency option, to support running the prerendering concurrently, potentially speeding up the build. (#​14380)
• Move RSCHydratedRouter and utils to /dom export. (#​14457)
• Ensure route navigation doesn't remove CSS link elements used by dynamic imports (#​14463)
• Typegen: only register route module types for routes within the app directory (#​14439)
• Updated dependencies:
  • react-router@7.9.5
  • @react-router/node@7.9.5
  • @react-router/serve@7.9.5

v7.9.4

Compare Source

Patch Changes

• Update valibot dependency to ^1.1.0 (#​14379)

• New (unstable) useRoute hook for accessing data from specific routes (#​14407)

  For example, let's say you have an admin route somewhere in your app and you want any child routes of admin to all have access to the loaderData and actionData from admin.

  // app/routes/admin.tsx
  import { Outlet } from "react-router";
  
  export const loader = () => ({ message: "Hello, loader!" });
  
  export const action = () => ({ count: 1 });
  
  export default function Component() {
    return (
      <div>
        {/* ... */}
        <Outlet />
        {/* ... */}
      </div>
    );
  }

  You might even want to create a reusable widget that all of the routes nested under admin could use:

  import { unstable_useRoute as useRoute } from "react-router";
  
  export function AdminWidget() {
    // How to get `message` and `count` from `admin` route?
  }

  In framework mode, useRoute knows all your app's routes and gives you TS errors when invalid route IDs are passed in:

  export function AdminWidget() {
    const admin = useRoute("routes/dmin");
    //                      ^^^^^^^^^^^
  }

  useRoute returns undefined if the route is not part of the current page:

  export function AdminWidget() {
    const admin = useRoute("routes/admin");
    if (!admin) {
      throw new Error(`AdminWidget used outside of "routes/admin"`);
    }
  }

  Note: the root route is the exception since it is guaranteed to be part of the current page.
  As a result, useRoute never returns undefined for root.

  loaderData and actionData are marked as optional since they could be accessed before the action is triggered or after the loader threw an error:

  export function AdminWidget() {
    const admin = useRoute("routes/admin");
    if (!admin) {
      throw new Error(`AdminWidget used outside of "routes/admin"`);
    }
    const { loaderData, actionData } = admin;
    console.log(loaderData);
    //          ^? { message: string } | undefined
    console.log(actionData);
    //          ^? { count: number } | undefined
  }

  If instead of a specific route, you wanted access to the current route's loaderData and actionData, you can call useRoute without arguments:

  export function AdminWidget() {
    const currentRoute = useRoute();
    currentRoute.loaderData;
    currentRoute.actionData;
  }

  This usage is equivalent to calling useLoaderData and useActionData, but consolidates all route data access into one hook: useRoute.

  Note: when calling useRoute() (without a route ID), TS has no way to know which route is the current route.
  As a result, loaderData and actionData are typed as unknown.
  If you want more type-safety, you can either narrow the type yourself with something like zod or you can refactor your app to pass down typed props to your AdminWidget:

  export function AdminWidget({
    message,
    count,
  }: {
    message: string;
    count: number;
  }) {
    /* ... */
  }

• Updated dependencies:

  • react-router@7.9.4
  • @react-router/node@7.9.4
  • @react-router/serve@7.9.4

remix-run/react-router (@​react-router/serve)

v7.12.0

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.12.0
  • @react-router/node@7.12.0
  • @react-router/express@7.12.0

v7.11.0

Compare Source

Patch Changes

• support custom entrypoints for RSC framework mode (#​14643)
• Update compression and morgan dependencies to address on-headers CVE: GHSA-76c9-3jph-rj3q (#​14652)
• Updated dependencies:
  • react-router@7.11.0
  • @react-router/node@7.11.0
  • @react-router/express@7.11.0

v7.10.1

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.10.1
  • @react-router/node@7.10.1
  • @react-router/express@7.10.1

v7.10.0

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.10.0
  • @react-router/node@7.10.0
  • @react-router/express@7.10.0

v7.9.6

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.9.6
  • @react-router/node@7.9.6
  • @react-router/express@7.9.6

v7.9.5

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.9.5
  • @react-router/node@7.9.5
  • @react-router/express@7.9.5

v7.9.4

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.9.4
  • @react-router/node@7.9.4
  • @react-router/express@7.9.4

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.