reactRouter 0.2.0
CRAN submission. Major release upgrading the package to React Router v7 with the data router API (loaders, actions, fetchers, deferred data).
Breaking changes
-
RouterProvider()now takes arouterargument built withcreate*Router()instead of route children. -
data()was renamed todataResponse()andreplace()was renamed toreplaceResponse()to avoid masking base R functions. -
reloadDocumentonLink()/NavLink()defaults toFALSE.
New features
- Updated to React Router v7 (
react-router-dom7.x). - Data router API:
createBrowserRouter(),createHashRouter(),createMemoryRouter()paired withRouterProvider(router = ...)— the recommended way to use loaders, actions, fetchers, andAwait. - New components:
Await,Form,ScrollRestoration,Outlet,Routes,Navigate. - New hooks:
useLoaderData,useActionData,useNavigation,useNavigate,useNavigationType,useMatch,useMatches,useSearchParams,useRouteError,useRouteLoaderData,useFetcher,useFetchers,useRevalidator,useBlocker,useSubmit, and more. - New loader/action helpers:
redirect(),replaceResponse(),redirectDocument(),dataResponse().
Security
-
redirect(),replaceResponse(), andredirectDocument()reject unsafe URL schemes (javascript:,data:,vbscript:) and protocol-relative targets. -
reactRouterExample()validatesexampleagainst the list of bundled examples, closing a path-traversal vector in user-supplied input. - New vignette: “Security considerations” — guidance on loaders/actions as client-side code, URL-encoding route params, redirect targets, CSP, and more.
Diagnostics & ergonomics
-
Route()validates thatloaderandactioninherit fromJS_EVALat call time, surfacing a common mistake before it becomes a browser-side error. -
dataResponse():valueis now a required argument. -
useNavigate(),useSubmit(), anduseLinkClickHandler()refuseinto=withas = "children"and point torender = JS(...)oras = "onClick"— these hooks return functions, not renderable children. -
RouterProviderlogs a dev-mode warning when the route tree changes after mount; remount via akeyprop to apply new routes.
