v10.0.0

What's Changed

New Features

• Use the configured secret when signing and verifying CSRF tokens by @sergiodxa in #584
• Move CSRF to use HMAC-SHA256 for token signing and add constant-time compare by @novanish in #558
• Expand the ExternalScripts functionality to support global attributes including data-* by @metalix2 in #495
• Add support for CSS files in route manifest by @nicksrandall in #290
• Optionally hide <HoneypotInput /> by external CSS class by @wenzf in #596
• Add nonce prop to ExternalScripts by @mnemitz in #448
• Handle multi-line data while composing SSE by @atesgoral in #250

Documentation Changes

• Fix lack of context argument in serverTimingMiddleware by @wenzf in #595

Other Changes

• Upgrade minimal required React Router version to 8.0.0 by @theskillwithin in #598
• Remove type-fest dependency by @tmcw in #562

New Contributors

• @wenzf made their first contribution in #595
• @theskillwithin made their first contribution in #598
• @tmcw made their first contribution in #562
• @novanish made their first contribution in #558
• @metalix2 made their first contribution in #495
• @nicksrandall made their first contribution in #290
• @atesgoral made their first contribution in #250

Full Changelog: v9.3.1...v10.0.0