|
1 | 1 | # `@react-router/dev` |
2 | 2 |
|
| 3 | +## 7.12.0-pre.0 |
| 4 | + |
| 5 | +### Minor Changes |
| 6 | + |
| 7 | +- Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the `react-router.config.ts` config `allowedActionOrigins` field. ([#14708](https://github.com/remix-run/react-router/pull/14708)) |
| 8 | + |
| 9 | +### Patch Changes |
| 10 | + |
| 11 | +- Fix `Maximum call stack size exceeded` errors when HMR is triggered against code with cyclic imports ([#14522](https://github.com/remix-run/react-router/pull/14522)) |
| 12 | +- fix(vite): Skip SSR middleware in preview server for SPA mode ([#14673](https://github.com/remix-run/react-router/pull/14673)) |
| 13 | +- [UNSTABLE] Add a new `future.unstable_trailingSlashAwareDataRequests` flag to provide consistent behavior of `request.pathname` inside `middleware`, `loader`, and `action` functions on document and data requests when a trailing slash is present in the browser URL. ([#14644](https://github.com/remix-run/react-router/pull/14644)) |
| 14 | + |
| 15 | + Currently, your HTTP and `request` pathnames would be as follows for `/a/b/c` and `/a/b/c/` |
| 16 | + |
| 17 | + | URL `/a/b/c` | **HTTP pathname** | **`request` pathname`** | |
| 18 | + | ------------ | ----------------- | ----------------------- | |
| 19 | + | **Document** | `/a/b/c` | `/a/b/c` ✅ | |
| 20 | + | **Data** | `/a/b/c.data` | `/a/b/c` ✅ | |
| 21 | + |
| 22 | + | URL `/a/b/c/` | **HTTP pathname** | **`request` pathname`** | |
| 23 | + | ------------- | ----------------- | ----------------------- | |
| 24 | + | **Document** | `/a/b/c/` | `/a/b/c/` ✅ | |
| 25 | + | **Data** | `/a/b/c.data` | `/a/b/c` ⚠️ | |
| 26 | + |
| 27 | + With this flag enabled, these pathnames will be made consistent though a new `_.data` format for client-side `.data` requests: |
| 28 | + |
| 29 | + | URL `/a/b/c` | **HTTP pathname** | **`request` pathname`** | |
| 30 | + | ------------ | ----------------- | ----------------------- | |
| 31 | + | **Document** | `/a/b/c` | `/a/b/c` ✅ | |
| 32 | + | **Data** | `/a/b/c.data` | `/a/b/c` ✅ | |
| 33 | + |
| 34 | + | URL `/a/b/c/` | **HTTP pathname** | **`request` pathname`** | |
| 35 | + | ------------- | ------------------ | ----------------------- | |
| 36 | + | **Document** | `/a/b/c/` | `/a/b/c/` ✅ | |
| 37 | + | **Data** | `/a/b/c/_.data` ⬅️ | `/a/b/c/` ✅ | |
| 38 | + |
| 39 | + This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic. |
| 40 | + |
| 41 | + Enabling this flag also changes the format of client side `.data` requests from `/_root.data` to `/_.data` when navigating to `/` to align with the new format. This does not impact the `request` pathname which is still `/` in all cases. |
| 42 | + |
| 43 | +- Updated dependencies: |
| 44 | + |
| 45 | + - `@react-router/[email protected]` |
| 46 | + - `@react-router/[email protected]` |
| 47 | + |
3 | 48 | ## 7.11.0 |
4 | 49 |
|
5 | 50 | ### Minor Changes |
|
0 commit comments