7.5.0 (from changelog)

Date: 2025-04-04

What's Changed

route.lazy Object API

We've introduced a new route.lazy API which gives you more granular control over the lazy loading of route properties that you could not achieve with the route.lazy() function signature. This is useful for Framework mode and performance-critical library mode applications.

createBrowserRouter([
  {
    path: "/show/:showId",
    lazy: {
      loader: async () => (await import("./show.loader.js")).loader,
      action: async () => (await import("./show.action.js")).action,
      Component: async () => (await import("./show.component.js")).Component,
    },
  },
]);

⚠️ This is a breaking change if you have adopted the route.unstable_lazyMiddleware API which has been removed in favor of route.lazy.unstable_middleware. See the Unstable Changes section below for more information.

Minor Changes

• react-router - Add granular object-based API for route.lazy to support lazy loading of individual route properties (#13294)

Patch Changes

• @react-router/dev - Update optional wrangler peer dependency range to support wrangler v4 (#13258)
• @react-router/dev - Reinstate dependency optimization in the child compiler to fix depsOptimizer is required in dev mode errors when using vite-plugin-cloudflare and importing Node.js builtins (#13317)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• react-router - Introduce future.unstable_subResourceIntegrity flag that enables generation of an importmap with integrity for the scripts that will be loaded by the browser (#13163)
• react-router - Remove support for the route.unstable_lazyMiddleware property (#13294)
  • In order to lazily load middleware, you can use the new object-based route.lazy.unstable_middleware API
• @react-router/dev - When future.unstable_viteEnvironmentApi is enabled, ensure critical CSS in development works when using a custom Vite base has been configured (#13305)

Changes by Package

• create-react-router
• react-router
• @react-router/architect
• @react-router/cloudflare
• @react-router/dev
• @react-router/express
• @react-router/fs-routes
• @react-router/node
• @react-router/remix-config-routes-adapter
• @react-router/serve

Full Changelog: v7.4.1...v7.5.0

7.4.1 (from changelog)

Date: 2025-03-28

Security Notice

Fixed a security vulnerability that allowed URL manipulation and potential cache pollution via the Host and X-Forwarded-Host headers due to inadequate port sanitization.

Patch Changes

• react-router - Dedupe calls to route.lazy functions (#13260)
• @react-router/dev - Fix path in prerender error messages (#13257)
• @react-router/dev - Fix typegen for virtual modules when moduleDetection is set to force (#13267)
• @react-router/express - Better validation of x-forwarded-host header to prevent potential security issues (#13309)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• react-router - Fix types on unstable_MiddlewareFunction to avoid type errors when a middleware doesn't return a value (#13311)
• react-router - Add support for route.unstable_lazyMiddleware function to allow lazy loading of middleware logic (#13210)
  • ⚠️ We do not recommend adoption of this API currently as we are likely going to change it prior to the stable release of middleware
  • ⚠️ This may be a breaking change if your app is currently returning unstable_middleware from route.lazy
  • The route.unstable_middleware property is no longer supported in the return value from route.lazy
  • If you want to lazily load middleware, you must use route.unstable_lazyMiddleware
• @react-router/dev - When both future.unstable_middleware and future.unstable_splitRouteModules are enabled, split unstable_clientMiddleware route exports into separate chunks when possible (#13210)
• @react-router/dev - Improve performance of future.unstable_middleware by ensuring that route modules are only blocking during the middleware phase when the unstable_clientMiddleware has been defined (#13210)

Full Changelog: v7.4.0...v7.4.1

7.4.0 (from changelog)

Date: 2025-03-19

Minor Changes

• @react-router/dev - Generate types for virtual:react-router/server-build module (#13152)

Patch Changes

• react-router - Fix root loader data on initial load redirects in SPA mode (#13222)
• react-router - Load ancestor pathless/index routes in lazy route discovery for upwards non-eager-discovery routing (#13203)
• react-router - Fix shouldRevalidate behavior for clientLoader-only routes in ssr:true apps (#13221)
• @react-router/dev - Fix conflicts with other Vite plugins that use the configureServer and/or configurePreviewServer hooks (#13184)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• react-router - If a middleware throws an error, ensure we only bubble the error itself via next() and are no longer leaking the MiddlewareError implementation detail (#13180)
  • ⚠️ This may be a breaking change if you are catch-ing errors thrown by the next() function in your middlewares
• react-router - Fix RequestHandler loadContext parameter type when middleware is enabled (#13204)
• react-router - Update Route.unstable_MiddlewareFunction to have a return value of Response | undefined instead of Response | void (#13199)
• @react-router/dev - When future.unstable_splitRouteModules is set to "enforce", allow both splittable and unsplittable root route exports since it's always in a single chunk (#13238)
• @react-router/dev - When future.unstable_viteEnvironmentApi is enabled, allow plugins that override the default SSR environment (such as @cloudflare/vite-plugin) to be placed before or after the React Router plugin (#13183)

Changes by Package

• create-react-router
• react-router
• @react-router/architect
• @react-router/cloudflare
• @react-router/dev
• @react-router/express
• @react-router/fs-routes
• @react-router/node
• @react-router/remix-config-routes-adapter
• @react-router/serve

Full Changelog: v7.3.0...v7.4.0

Does any of this look wrong? Please let us know.

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)