Merge branch 'release-next'

Author: brophdawg11

CHANGELOG.md

@@ -27,6 +27,7 @@
 - amitdahan
 - AmRo045
 - amsal
+- AnandShiva
 - Andarist
 - andreasottosson-polestar
 - andreiborza

contributors.yml

@@ -45,7 +45,7 @@ export default function Root() {
 ## Signature
 
 ```tsx
-function Links({ nonce }: LinksProps): React.JSX.Element
+function Links({ nonce, crossOrigin }: LinksProps): React.JSX.Element
 ```
 
 ## Props
@@ -56,3 +56,9 @@ A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_a
 attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
 element
 
+### crossOrigin
+
+A [`crossOrigin`](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin)
+attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
+element
+

docs/api/components/Links.md

@@ -30,6 +30,45 @@ export default {
 
 ## Options
 
+### `allowedActionOrigins`
+
+An array of allowed origin hosts for action submissions to UI routes (does not apply to resource routes). Supports micromatch glob patterns (`*` to match one segment, `**` to match multiple).
+
+```tsx filename=react-router.config.ts
+export default {
+  allowedActionOrigins: [
+    "example.com",
+    "*.example.com", // sub.example.com
+    "**.example.com", // sub.domain.example.com
+  ],
+} satisfies Config;
+```
+
+If you need to set this value at runtime, you can do in by setting the value on the server build in your custom server. For example, when using `express`:
+
+```ts
+import express from "express";
+import { createRequestHandler } from "@react-router/express";
+import type { ServerBuild } from "react-router";
+
+export const app = express();
+
+async function getBuild() {
+  let build: ServerBuild = await import(
+    "virtual:react-router/server-build"
+  );
+  return {
+    ...build,
+    allowedActionOrigins:
+      process.env.NODE_ENV === "development"
+        ? undefined
+        : ["staging.example.com", "www.example.com"],
+  };
+}
+
+app.use(createRequestHandler({ build: getBuild }));
+```
+
 ### `appDirectory`
 
 The path to the `app` directory, relative to the root directory. Defaults to `"app"`.
@@ -66,7 +105,11 @@ A function that is called after the full React Router build is complete.
 
 ```tsx filename=react-router.config.ts
 export default {
-  buildEnd: async ({ buildManifest, reactRouterConfig, viteConfig }) => {
+  buildEnd: async ({
+    buildManifest,
+    reactRouterConfig,
+    viteConfig,
+  }) => {
     // Custom build logic here
     console.log("Build completed!");
   },

docs/api/framework-conventions/react-router.config.ts.md

@@ -70,6 +70,7 @@ matchRSCServerRequest({
 
 ```tsx
 async function matchRSCServerRequest({
+  allowedActionOrigins,
   createTemporaryReferenceSet,
   basename,
   decodeReply,
@@ -82,6 +83,7 @@ async function matchRSCServerRequest({
   routes,
   generateResponse,
 }: {
+  allowedActionOrigins?: string[];
   createTemporaryReferenceSet: () => unknown;
   basename?: string;
   decodeReply?: DecodeReplyFunction;
@@ -107,6 +109,10 @@ async function matchRSCServerRequest({
 
 ## Params
 
+### opts.allowedActionOrigins
+
+Origin patterns that are allowed to execute actions.
+
 ### opts.basename
 
 The basename to use when matching the request.

docs/api/rsc/matchRSCServerRequest.md

@@ -5,6 +5,7 @@
 ### Minor Changes
 
 - Unstable Vite support for Node-based Remix apps ([#7590](https://github.com/remix-run/remix/pull/7590))
+
   - `remix build` 👉 `vite build && vite build --ssr`
   - `remix dev` 👉 `vite dev`
 

integration/CHANGELOG.md

@@ -1,7 +1,13 @@
 # `create-react-router`
 
+## 7.13.0
+
+_No changes_
+
 ## 7.12.0
 
+_No changes_
+
 ## 7.11.0
 
 _No changes_

packages/create-react-router/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "create-react-router",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Create a new React Router app",
   "homepage": "https://reactrouter.com",
   "bugs": {

packages/create-react-router/package.json

@@ -1,5 +1,13 @@
 # `@react-router/architect`
 
+## 7.13.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.13.0`
+  - `@react-router/node@7.13.0`
+
 ## 7.12.0
 
 ### Patch Changes
@@ -87,6 +95,7 @@
 - Stabilize middleware and context APIs. ([#14215](https://github.com/remix-run/react-router/pull/14215))
 
   We have removed the `unstable_` prefix from the following APIs and they are now considered stable and ready for production use:
+
   - [`RouterContextProvider`](https://reactrouter.com/api/utils/RouterContextProvider)
   - [`createContext`](https://reactrouter.com/api/utils/createContext)
   - `createBrowserRouter` [`getContext`](https://reactrouter.com/api/data-routers/createBrowserRouter#optsgetcontext) option
@@ -310,6 +319,7 @@
 ### Major Changes
 
 - For Remix consumers migrating to React Router, the `crypto` global from the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) is now required when using cookie and session APIs. This means that the following APIs are provided from `react-router` rather than platform-specific packages: ([#11837](https://github.com/remix-run/react-router/pull/11837))
+
   - `createCookie`
   - `createCookieSessionStorage`
   - `createMemorySessionStorage`
@@ -318,6 +328,7 @@
   For consumers running older versions of Node, the `installGlobals` function from `@remix-run/node` has been updated to define `globalThis.crypto`, using [Node's `require('node:crypto').webcrypto` implementation.](https://nodejs.org/api/webcrypto.html)
 
   Since platform-specific packages no longer need to implement this API, the following low-level APIs have been removed:
+
   - `createCookieFactory`
   - `createSessionStorageFactory`
   - `createCookieSessionStorageFactory`

packages/react-router-architect/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@react-router/architect",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Architect server request handler for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"