CRAN submission. Major release upgrading the package to React Router v7
with the data router API (loaders, actions, fetchers, deferred data).
Breaking changes
RouterProvider()now takes arouterargument built with
create*Router()instead of route children.data()was renamed todataResponse()andreplace()was renamed to
replaceResponse()to avoid masking base R functions.reloadDocumentonLink()/NavLink()defaults toFALSE.
New features
- Updated to React Router v7 (
react-router-dom7.x). - Data router API:
createBrowserRouter(),createHashRouter(),
createMemoryRouter()paired withRouterProvider(router = ...)—
the recommended way to use loaders, actions, fetchers, andAwait. - New components:
Await,Form,ScrollRestoration,Outlet,Routes,
Navigate. - New hooks:
useLoaderData,useActionData,useNavigation,
useNavigate,useNavigationType,useMatch,useMatches,
useSearchParams,useRouteError,useRouteLoaderData,useFetcher,
useFetchers,useRevalidator,useBlocker,useSubmit, and more. - New loader/action helpers:
redirect(),replaceResponse(),
redirectDocument(),dataResponse().
Security
redirect(),replaceResponse(), andredirectDocument()reject unsafe
URL schemes (javascript:,data:,vbscript:) and protocol-relative
targets.reactRouterExample()validatesexampleagainst the list of bundled
examples, closing a path-traversal vector in user-supplied input.- New vignette: "Security considerations" — guidance on loaders/actions as
client-side code, URL-encoding route params, redirect targets, CSP, and more.
Diagnostics & ergonomics
Route()validates thatloaderandactioninherit fromJS_EVALat
call time, surfacing a common mistake before it becomes a browser-side error.dataResponse():valueis now a required argument.useNavigate(),useSubmit(), anduseLinkClickHandler()refuse
into=withas = "children"and point torender = JS(...)or
as = "onClick"— these hooks return functions, not renderable children.RouterProviderlogs a dev-mode warning when the route tree changes after
mount; remount via akeyprop to apply new routes.