# What changed in @remix-run/router

> 16 changes in @remix-run/router 1 to 7 from its official release notes, upgrade guides and advisories: 9 breaking, 2 security, 5 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/@remix-run/router/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @remix-run/router 7

### Breaking changes

- Cloudflare projects should use this plugin instead of the removed React Router Cloudflare dev proxy. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- The React Router Cloudflare dev proxy is removed; replace it with the cloudflare plugin from @cloudflare/vite-plugin. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- Use loaderData instead of deprecated data fields in meta arguments, matched route data, and useMatches() results. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- React Router v8 requires Node 22.22 or later. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- React Router v8 requires React and react-dom 19.2.7 or later. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- The re-export package is removed; import general APIs from react-router and DOM-specific APIs from react-router/dom. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- Use this import path for DOM-specific APIs after the react-router-dom re-export package is removed. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- This option is removed in v8 because event.requestContext.domainName becomes the default source for the request host, falling back to Host. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- Framework mode requires Vite 7 or later, along with the v8 Vite Environment API future flag. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)

### New APIs and options

- Opting in enables middleware to run code before and after Response generation for a matched path. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- Opting in passes the raw HTTP request to handlers instead of normalizing its URL; use the sibling url parameter for the normalized location. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- Opting in splits client-side route exports into independently loaded chunks, allowing them to run while the route component downloads. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- Opting in preserves trailing-slash semantics in data request URLs, using `/_.data` for trailing-slash routes and the root data request. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)
- Opting in enables support for Vite's experimental Environment API; custom SSR build configuration may need to move under per-environment configuration. (7.0.0) — [upgrade guide](https://reactrouter.com/upgrading/v7)

## @remix-run/router 1

### Security

- React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation (1.23.3) — [security advisory](https://github.com/advisories/GHSA-2J2X-HQR9-3H42)
- React Router vulnerable to XSS via Open Redirects (1.23.2) — [security advisory](https://github.com/advisories/GHSA-2W69-QVJG-HVJX)