npm / @remix-run/router
@remix-run/router
What changed in @remix-run/router 1 to 7, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
9 breaking2 security5 new APIs and options
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@remix-run/router 714 changes
Breaking changes 9
Cloudflare projects should use this plugin instead of the removed React Router Cloudflare dev proxy.
The React Router Cloudflare dev proxy is removed; replace it with the cloudflare plugin from @cloudflare/vite-plugin.
Use loaderData instead of deprecated data fields in meta arguments, matched route data, and useMatches() results.
React Router v8 requires Node 22.22 or later.
React Router v8 requires React and react-dom 19.2.7 or later.
The re-export package is removed; import general APIs from react-router and DOM-specific APIs from react-router/dom.
Use this import path for DOM-specific APIs after the react-router-dom re-export package is removed.
This option is removed in v8 because event.requestContext.domainName becomes the default source for the request host, falling back to Host.
Framework mode requires Vite 7 or later, along with the v8 Vite Environment API future flag.
New APIs and options 5
Opting in enables middleware to run code before and after Response generation for a matched path.
Opting in passes the raw HTTP request to handlers instead of normalizing its URL; use the sibling url parameter for the normalized location.
Opting in splits client-side route exports into independently loaded chunks, allowing them to run while the route component downloads.
Opting in preserves trailing-slash semantics in data request URLs, using
/_.datafor trailing-slash routes and the root data request.Opting in enables support for Vite's experimental Environment API; custom SSR build configuration may need to move under per-environment configuration.
@remix-run/router 12 changes
Security 2
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
React Router vulnerable to XSS via Open Redirects