chore(deps): update react-router to v8.3.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@react-router/dev (source)	8.2.0 → 8.3.0
react-router (source)	8.2.0 → 8.3.0

---

Release Notes

remix-run/react-router (@​react-router/dev)

v8.3.0

Compare Source

Minor Changes

• Restart react-router dev with --conditions=development when not already configured (#​15291)

Patch Changes

• Allow typescript@7 to be used (#​15317)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Add unstable_rsc/client-version client build version virtual module (#​15318)

• Support the subResourceIntegrity config option in RSC Framework Mode (#​15321)

Migration guide

No changes are required when using the default RSC SSR entry. If you maintain a custom app/entry.ssr.tsx, import the new virtual module and pass its hashes to React's importMap render option:

+import subResourceIntegrity from "virtual:react-router/unstable_rsc/subresource-integrity";

return renderToReadableStream(<RSCStaticRouter getPayload={getPayload} />, {
  ...options,
  bootstrapScriptContent,
  formState,
+ importMap: subResourceIntegrity
+   ? { integrity: subResourceIntegrity }
+   : undefined,
  signal: request.signal,
});

• Updated dependencies:
  • react-router@8.3.0
  • @react-router/node@8.3.0
  • @react-router/serve@8.3.0

remix-run/react-router (react-router)

v8.3.0

Compare Source

Patch Changes

• Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#​15310)
  • Characters that are valid literally in a path segment ($ & + , ; = : @​ — RFC 3986 pchar) are no longer percent-encoded, so values like a semver build 1.0.0+1 interpolate unchanged instead of becoming 1.0.0%2B1
  • Structural/unsafe characters (/ ? # %, whitespace, non-ASCII) are still escaped exactly as before
• Use crypto.randomUUID() for createMemorySessionStorage session ids (#​15302)
  • createMemorySessionStorage is only intended for local development and testing - sessions are lost when the server restarts
• Fix NavLink not applying its pending state when to has a trailing slash (#​15300)
• Preserve RSC route component metadata so routes with a clientLoader can skip unnecessary server requests once their components have rendered while still fetching missing server-rendered elements (#​15323)
• Harden RSC CSRF code paths (#​15311)
• Fix server crash (TypeError: Invalid state: Unable to enqueue) when a request is aborted while the RSC HTML stream has a pending flush (#​15286)
  • Handle cancellation of the injectRSCPayload readable side, clear the pending flush, and cancel the underlying RSC payload stream

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Detect stale RSC clients during lazy route discovery and reload the destination document (#​15318)

Migration

Apps using the default RSC Framework entry do not need to make any changes. Apps with a custom entry.rsc.tsx should import the generated client version and pass it to unstable_matchRSCServerRequest:

import clientVersion from "virtual:react-router/unstable_rsc/client-version";

return unstable_matchRSCServerRequest({
  // ...
  clientVersion,
});

• Add CSP nonce support to RSC document rendering (#​15320)

  • Add nonce options to unstable_routeRSCServerRequest and unstable_RSCStaticRouter
  • Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components

  To adopt nonce-based CSP, update your entry.ssr.tsx (run react-router reveal entry.ssr first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to routeRSCServerRequest, spread the renderHTML options into React's HTML renderer, pass options.nonce to RSCStaticRouter, and use the same nonce in the Content-Security-Policy response header:

  const nonce = crypto.randomUUID();
  const response = await routeRSCServerRequest({
    request,
    serverResponse,
    createFromReadableStream,
    nonce,
    async renderHTML(getPayload, options) {
      const payload = getPayload();
      return renderHTMLToReadableStream(
        <RSCStaticRouter getPayload={getPayload} nonce={options.nonce} />,
        {
          ...options,
          bootstrapScriptContent,
          formState: await payload.formState,
          signal: request.signal,
        },
      );
    },
  });
  response.headers.set(
    "Content-Security-Policy",
    `script-src 'self' 'nonce-${nonce}'`,
  );

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	8b877f6
Status:	✅  Deploy successful!
Preview URL:	https://3fc52e61.mouseterm.pages.dev
Branch Preview URL:	https://renovate-react-router.mouseterm.pages.dev

View logs