remix-run · brophdawg11 · Jan 6, 2026 · Jan 6, 2026
diff --git a/.changeset/pre.json b/.changeset/pre.json
@@ -34,5 +34,16 @@
     "@playground/split-route-modules-spa": "0.0.0",
     "@playground/vite-plugin-cloudflare": "0.0.0"
   },
-  "changesets": []
+  "changesets": [
+    "beige-wasps-cover",
+    "early-moles-drum",
+    "fix-spa-vite-preview",
+    "friendly-moose-argue",
+    "fuzzy-worms-decide",
+    "hungry-pears-battle",
+    "little-timers-occur",
+    "serious-bobcats-impress",
+    "spotty-masks-beg",
+    "young-geese-pay"
+  ]
 }
diff --git a/packages/create-react-router/CHANGELOG.md b/packages/create-react-router/CHANGELOG.md
@@ -1,5 +1,7 @@
 # `create-react-router`
 
+## 7.12.0-pre.0
+
 ## 7.11.0
 
 _No changes_

diff --git a/packages/create-react-router/package.json b/packages/create-react-router/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-react-router",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Create a new React Router app",
   "homepage": "https://reactrouter.com",
   "bugs": {

diff --git a/packages/react-router-architect/CHANGELOG.md b/packages/react-router-architect/CHANGELOG.md
@@ -1,5 +1,13 @@
 # `@react-router/architect`
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.12.0-pre.0`
+  - `@react-router/node@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-architect/package.json b/packages/react-router-architect/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/architect",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Architect server request handler for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-cloudflare/CHANGELOG.md b/packages/react-router-cloudflare/CHANGELOG.md
@@ -1,5 +1,12 @@
 # `@react-router/cloudflare`
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-cloudflare/package.json b/packages/react-router-cloudflare/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/cloudflare",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Cloudflare platform abstractions for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-dev/CHANGELOG.md b/packages/react-router-dev/CHANGELOG.md
@@ -1,5 +1,50 @@
 # `@react-router/dev`
 
+## 7.12.0-pre.0
+
+### Minor Changes
+
+- Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the `react-router.config.ts` config `allowedActionOrigins` field. ([#14708](https://github.com/remix-run/react-router/pull/14708))
+
+### Patch Changes
+
+- Fix `Maximum call stack size exceeded` errors when HMR is triggered against code with cyclic imports ([#14522](https://github.com/remix-run/react-router/pull/14522))
+- fix(vite): Skip SSR middleware in preview server for SPA mode ([#14673](https://github.com/remix-run/react-router/pull/14673))
+- [UNSTABLE] Add a new `future.unstable_trailingSlashAwareDataRequests` flag to provide consistent behavior of `request.pathname` inside `middleware`, `loader`, and `action` functions on document and data requests when a trailing slash is present in the browser URL. ([#14644](https://github.com/remix-run/react-router/pull/14644))
+
+  Currently, your HTTP and `request` pathnames would be as follows for `/a/b/c` and `/a/b/c/`
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname`** |
+  | ------------ | ----------------- | ----------------------- |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅             |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅             |
+
+  | URL `/a/b/c/` | **HTTP pathname** | **`request` pathname`** |
+  | ------------- | ----------------- | ----------------------- |
+  | **Document**  | `/a/b/c/`         | `/a/b/c/` ✅            |
+  | **Data**      | `/a/b/c.data`     | `/a/b/c` ⚠️             |
+
+  With this flag enabled, these pathnames will be made consistent though a new `_.data` format for client-side `.data` requests:
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname`** |
+  | ------------ | ----------------- | ----------------------- |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅             |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅             |
+
+  | URL `/a/b/c/` | **HTTP pathname**  | **`request` pathname`** |
+  | ------------- | ------------------ | ----------------------- |
+  | **Document**  | `/a/b/c/`          | `/a/b/c/` ✅            |
+  | **Data**      | `/a/b/c/_.data` ⬅️ | `/a/b/c/` ✅            |
+
+  This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.
+
+  Enabling this flag also changes the format of client side `.data` requests from `/_root.data` to `/_.data` when navigating to `/` to align with the new format. This does not impact the `request` pathname which is still `/` in all cases.
+
+- Updated dependencies:
+  - `react-router@7.12.0-pre.0`
+  - `@react-router/node@7.12.0-pre.0`
+  - `@react-router/serve@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Minor Changes

diff --git a/packages/react-router-dev/package.json b/packages/react-router-dev/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/dev",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Dev tools and CLI for React Router",
   "homepage": "https://reactrouter.com",
   "bugs": {

diff --git a/packages/react-router-dom/CHANGELOG.md b/packages/react-router-dom/CHANGELOG.md
@@ -1,5 +1,12 @@
 # react-router-dom
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-dom/package.json b/packages/react-router-dom/package.json
@@ -1,6 +1,6 @@
 {
   "name": "react-router-dom",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Declarative routing for React web applications",
   "keywords": [
     "react",

diff --git a/packages/react-router-express/CHANGELOG.md b/packages/react-router-express/CHANGELOG.md
@@ -1,5 +1,13 @@
 # `@react-router/express`
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.12.0-pre.0`
+  - `@react-router/node@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-express/package.json b/packages/react-router-express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/express",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Express server request handler for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-fs-routes/CHANGELOG.md b/packages/react-router-fs-routes/CHANGELOG.md
@@ -1,5 +1,12 @@
 # `@react-router/fs-routes`
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `@react-router/dev@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-fs-routes/package.json b/packages/react-router-fs-routes/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/fs-routes",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "File system routing conventions for React Router, for use within routes.ts",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-node/CHANGELOG.md b/packages/react-router-node/CHANGELOG.md
@@ -1,5 +1,12 @@
 # `@react-router/node`
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-node/package.json b/packages/react-router-node/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/node",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Node.js platform abstractions for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-remix-routes-option-adapter/CHANGELOG.md b/packages/react-router-remix-routes-option-adapter/CHANGELOG.md
@@ -1,5 +1,12 @@
 # `@react-router/remix-config-routes-adapter`
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `@react-router/dev@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-remix-routes-option-adapter/package.json b/packages/react-router-remix-routes-option-adapter/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/remix-routes-option-adapter",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Adapter for Remix's \"routes\" config option, for use within routes.ts",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-serve/CHANGELOG.md b/packages/react-router-serve/CHANGELOG.md
@@ -1,5 +1,14 @@
 # `@react-router/serve`
 
+## 7.12.0-pre.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.12.0-pre.0`
+  - `@react-router/node@7.12.0-pre.0`
+  - `@react-router/express@7.12.0-pre.0`
+
 ## 7.11.0
 
 ### Patch Changes

diff --git a/packages/react-router-serve/package.json b/packages/react-router-serve/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/serve",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Production application server for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router/CHANGELOG.md b/packages/react-router/CHANGELOG.md
@@ -1,5 +1,50 @@
 # `react-router`
 
+## 7.12.0-pre.0
+
+### Minor Changes
+
+- Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the `react-router.config.ts` config `allowedActionOrigins` field. ([#14708](https://github.com/remix-run/react-router/pull/14708))
+
+### Patch Changes
+
+- Fix `generatePath` when used with suffixed params (i.e., "/books/:id.json") ([#14269](https://github.com/remix-run/react-router/pull/14269))
+- Export `UNSAFE_createMemoryHistory` and `UNSAFE_createHashHistory` alongside `UNSAFE_createBrowserHistory` for consistency. These are not intended to be used for new apps but intended to help apps usiong `unstable_HistoryRouter` migrate from v6->v7 so they can adopt the newer APIs. ([#14663](https://github.com/remix-run/react-router/pull/14663))
+- Escape HTML in scroll restoration keys ([#14705](https://github.com/remix-run/react-router/pull/14705))
+- Validate redirect locations ([#14706](https://github.com/remix-run/react-router/pull/14706))
+- [UNSTABLE] Pass `<Scripts nonce>` value through to the underlying `importmap` `script` tag when using `future.unstable_subResourceIntegrity` ([#14675](https://github.com/remix-run/react-router/pull/14675))
+- [UNSTABLE] Add a new `future.unstable_trailingSlashAwareDataRequests` flag to provide consistent behavior of `request.pathname` inside `middleware`, `loader`, and `action` functions on document and data requests when a trailing slash is present in the browser URL. ([#14644](https://github.com/remix-run/react-router/pull/14644))
+
+  Currently, your HTTP and `request` pathnames would be as follows for `/a/b/c` and `/a/b/c/`
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname`** |
+  | ------------ | ----------------- | ----------------------- |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅             |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅             |
+
+  | URL `/a/b/c/` | **HTTP pathname** | **`request` pathname`** |
+  | ------------- | ----------------- | ----------------------- |
+  | **Document**  | `/a/b/c/`         | `/a/b/c/` ✅            |
+  | **Data**      | `/a/b/c.data`     | `/a/b/c` ⚠️             |
+
+  With this flag enabled, these pathnames will be made consistent though a new `_.data` format for client-side `.data` requests:
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname`** |
+  | ------------ | ----------------- | ----------------------- |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅             |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅             |
+
+  | URL `/a/b/c/` | **HTTP pathname**  | **`request` pathname`** |
+  | ------------- | ------------------ | ----------------------- |
+  | **Document**  | `/a/b/c/`          | `/a/b/c/` ✅            |
+  | **Data**      | `/a/b/c/_.data` ⬅️ | `/a/b/c/` ✅            |
+
+  This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.
+
+  Enabling this flag also changes the format of client side `.data` requests from `/_root.data` to `/_.data` when navigating to `/` to align with the new format. This does not impact the `request` pathname which is still `/` in all cases.
+
+- Preserve `clientLoader.hydrate=true` when using `<HydratedRouter unstable_instrumentations>` ([#14674](https://github.com/remix-run/react-router/pull/14674))
+
 ## 7.11.0
 
 ### Minor Changes

diff --git a/packages/react-router/package.json b/packages/react-router/package.json
@@ -1,6 +1,6 @@
 {
   "name": "react-router",
-  "version": "7.11.0",
+  "version": "7.12.0-pre.0",
   "description": "Declarative routing for React",
   "keywords": [
     "react",