Merge branch 'release-next'

Author: brophdawg11

CHANGELOG.md

@@ -13,15 +13,19 @@ We manage release notes in this file instead of the paginated Github Releases Pa
   <summary>Table of Contents</summary>
 
 - [React Router Releases](#react-router-releases)
-  - [v7.4.0](#v740)
-    - [Minor Changes](#minor-changes)
+  - [v7.4.1](#v741)
+    - [Security Notice](#security-notice)
     - [Patch Changes](#patch-changes)
     - [Unstable Changes](#unstable-changes)
+  - [v7.4.0](#v740)
+    - [Minor Changes](#minor-changes)
+    - [Patch Changes](#patch-changes-1)
+    - [Unstable Changes](#unstable-changes-1)
     - [Changes by Package](#changes-by-package)
   - [v7.3.0](#v730)
     - [Minor Changes](#minor-changes-1)
-    - [Patch Changes](#patch-changes-1)
-    - [Unstable Changes](#unstable-changes-1)
+    - [Patch Changes](#patch-changes-2)
+    - [Unstable Changes](#unstable-changes-2)
       - [Client-side `context` (unstable)](#client-side-context-unstable)
       - [Middleware (unstable)](#middleware-unstable)
         - [Middleware `context` parameter](#middleware-context-parameter)
@@ -33,28 +37,28 @@ We manage release notes in this file instead of the paginated Github Releases Pa
       - [Prerendering with a SPA Fallback](#prerendering-with-a-spa-fallback)
       - [Allow a root `loader` in SPA Mode](#allow-a-root-loader-in-spa-mode)
     - [Minor Changes](#minor-changes-2)
-    - [Patch Changes](#patch-changes-2)
-    - [Unstable Changes](#unstable-changes-2)
+    - [Patch Changes](#patch-changes-3)
+    - [Unstable Changes](#unstable-changes-3)
       - [Split Route Modules (unstable)](#split-route-modules-unstable)
     - [Changes by Package](#changes-by-package-2)
   - [v7.1.5](#v715)
-    - [Patch Changes](#patch-changes-3)
-  - [v7.1.4](#v714)
     - [Patch Changes](#patch-changes-4)
-  - [v7.1.3](#v713)
+  - [v7.1.4](#v714)
     - [Patch Changes](#patch-changes-5)
-  - [v7.1.2](#v712)
+  - [v7.1.3](#v713)
     - [Patch Changes](#patch-changes-6)
-  - [v7.1.1](#v711)
+  - [v7.1.2](#v712)
     - [Patch Changes](#patch-changes-7)
+  - [v7.1.1](#v711)
+    - [Patch Changes](#patch-changes-8)
   - [v7.1.0](#v710)
     - [Minor Changes](#minor-changes-3)
-    - [Patch Changes](#patch-changes-8)
+    - [Patch Changes](#patch-changes-9)
     - [Changes by Package](#changes-by-package-3)
   - [v7.0.2](#v702)
-    - [Patch Changes](#patch-changes-9)
-  - [v7.0.1](#v701)
     - [Patch Changes](#patch-changes-10)
+  - [v7.0.1](#v701)
+    - [Patch Changes](#patch-changes-11)
   - [v7.0.0](#v700)
     - [Breaking Changes](#breaking-changes)
       - [Package Restructuring](#package-restructuring)
@@ -71,199 +75,199 @@ We manage release notes in this file instead of the paginated Github Releases Pa
     - [Major Changes (`react-router`)](#major-changes-react-router)
     - [Major Changes (`@react-router/*`)](#major-changes-react-router-1)
     - [Minor Changes](#minor-changes-4)
-    - [Patch Changes](#patch-changes-11)
+    - [Patch Changes](#patch-changes-12)
     - [Changes by Package](#changes-by-package-4)
 - [React Router v6 Releases](#react-router-v6-releases)
   - [v6.30.0](#v6300)
     - [Minor Changes](#minor-changes-5)
-    - [Patch Changes](#patch-changes-12)
+    - [Patch Changes](#patch-changes-13)
   - [v6.29.0](#v6290)
     - [Minor Changes](#minor-changes-6)
-    - [Patch Changes](#patch-changes-13)
-  - [v6.28.2](#v6282)
     - [Patch Changes](#patch-changes-14)
-  - [v6.28.1](#v6281)
+  - [v6.28.2](#v6282)
     - [Patch Changes](#patch-changes-15)
+  - [v6.28.1](#v6281)
+    - [Patch Changes](#patch-changes-16)
   - [v6.28.0](#v6280)
     - [What's Changed](#whats-changed-1)
     - [Minor Changes](#minor-changes-7)
-    - [Patch Changes](#patch-changes-16)
+    - [Patch Changes](#patch-changes-17)
   - [v6.27.0](#v6270)
     - [What's Changed](#whats-changed-2)
       - [Stabilized APIs](#stabilized-apis)
     - [Minor Changes](#minor-changes-8)
-    - [Patch Changes](#patch-changes-17)
-  - [v6.26.2](#v6262)
     - [Patch Changes](#patch-changes-18)
-  - [v6.26.1](#v6261)
+  - [v6.26.2](#v6262)
     - [Patch Changes](#patch-changes-19)
+  - [v6.26.1](#v6261)
+    - [Patch Changes](#patch-changes-20)
   - [v6.26.0](#v6260)
     - [Minor Changes](#minor-changes-9)
-    - [Patch Changes](#patch-changes-20)
-  - [v6.25.1](#v6251)
     - [Patch Changes](#patch-changes-21)
+  - [v6.25.1](#v6251)
+    - [Patch Changes](#patch-changes-22)
   - [v6.25.0](#v6250)
     - [What's Changed](#whats-changed-3)
       - [Stabilized `v7_skipActionErrorRevalidation`](#stabilized-v7_skipactionerrorrevalidation)
     - [Minor Changes](#minor-changes-10)
-    - [Patch Changes](#patch-changes-22)
-  - [v6.24.1](#v6241)
     - [Patch Changes](#patch-changes-23)
+  - [v6.24.1](#v6241)
+    - [Patch Changes](#patch-changes-24)
   - [v6.24.0](#v6240)
     - [What's Changed](#whats-changed-4)
       - [Lazy Route Discovery (a.k.a. "Fog of War")](#lazy-route-discovery-aka-fog-of-war)
     - [Minor Changes](#minor-changes-11)
-    - [Patch Changes](#patch-changes-24)
-  - [v6.23.1](#v6231)
     - [Patch Changes](#patch-changes-25)
+  - [v6.23.1](#v6231)
+    - [Patch Changes](#patch-changes-26)
   - [v6.23.0](#v6230)
     - [What's Changed](#whats-changed-5)
       - [Data Strategy (unstable)](#data-strategy-unstable)
       - [Skip Action Error Revalidation (unstable)](#skip-action-error-revalidation-unstable)
     - [Minor Changes](#minor-changes-12)
   - [v6.22.3](#v6223)
-    - [Patch Changes](#patch-changes-26)
-  - [v6.22.2](#v6222)
     - [Patch Changes](#patch-changes-27)
-  - [v6.22.1](#v6221)
+  - [v6.22.2](#v6222)
     - [Patch Changes](#patch-changes-28)
+  - [v6.22.1](#v6221)
+    - [Patch Changes](#patch-changes-29)
   - [v6.22.0](#v6220)
     - [What's Changed](#whats-changed-6)
       - [Core Web Vitals Technology Report Flag](#core-web-vitals-technology-report-flag)
     - [Minor Changes](#minor-changes-13)
-    - [Patch Changes](#patch-changes-29)
-  - [v6.21.3](#v6213)
     - [Patch Changes](#patch-changes-30)
-  - [v6.21.2](#v6212)
+  - [v6.21.3](#v6213)
     - [Patch Changes](#patch-changes-31)
-  - [v6.21.1](#v6211)
+  - [v6.21.2](#v6212)
     - [Patch Changes](#patch-changes-32)
+  - [v6.21.1](#v6211)
+    - [Patch Changes](#patch-changes-33)
   - [v6.21.0](#v6210)
     - [What's Changed](#whats-changed-7)
       - [`future.v7_relativeSplatPath`](#futurev7_relativesplatpath)
       - [Partial Hydration](#partial-hydration)
     - [Minor Changes](#minor-changes-14)
-    - [Patch Changes](#patch-changes-33)
-  - [v6.20.1](#v6201)
     - [Patch Changes](#patch-changes-34)
+  - [v6.20.1](#v6201)
+    - [Patch Changes](#patch-changes-35)
   - [v6.20.0](#v6200)
     - [Minor Changes](#minor-changes-15)
-    - [Patch Changes](#patch-changes-35)
+    - [Patch Changes](#patch-changes-36)
   - [v6.19.0](#v6190)
     - [What's Changed](#whats-changed-8)
       - [`unstable_flushSync` API](#unstable_flushsync-api)
     - [Minor Changes](#minor-changes-16)
-    - [Patch Changes](#patch-changes-36)
+    - [Patch Changes](#patch-changes-37)
   - [v6.18.0](#v6180)
     - [What's Changed](#whats-changed-9)
       - [New Fetcher APIs](#new-fetcher-apis)
       - [Persistence Future Flag (`future.v7_fetcherPersist`)](#persistence-future-flag-futurev7_fetcherpersist)
     - [Minor Changes](#minor-changes-17)
-    - [Patch Changes](#patch-changes-37)
+    - [Patch Changes](#patch-changes-38)
   - [v6.17.0](#v6170)
     - [What's Changed](#whats-changed-10)
       - [View Transitions 🚀](#view-transitions-)
     - [Minor Changes](#minor-changes-18)
-    - [Patch Changes](#patch-changes-38)
+    - [Patch Changes](#patch-changes-39)
   - [v6.16.0](#v6160)
     - [Minor Changes](#minor-changes-19)
-    - [Patch Changes](#patch-changes-39)
+    - [Patch Changes](#patch-changes-40)
   - [v6.15.0](#v6150)
     - [Minor Changes](#minor-changes-20)
-    - [Patch Changes](#patch-changes-40)
-  - [v6.14.2](#v6142)
     - [Patch Changes](#patch-changes-41)
-  - [v6.14.1](#v6141)
+  - [v6.14.2](#v6142)
     - [Patch Changes](#patch-changes-42)
+  - [v6.14.1](#v6141)
+    - [Patch Changes](#patch-changes-43)
   - [v6.14.0](#v6140)
     - [What's Changed](#whats-changed-11)
       - [JSON/Text Submissions](#jsontext-submissions)
     - [Minor Changes](#minor-changes-21)
-    - [Patch Changes](#patch-changes-43)
+    - [Patch Changes](#patch-changes-44)
   - [v6.13.0](#v6130)
     - [What's Changed](#whats-changed-12)
       - [`future.v7_startTransition`](#futurev7_starttransition)
     - [Minor Changes](#minor-changes-22)
-    - [Patch Changes](#patch-changes-44)
-  - [v6.12.1](#v6121)
     - [Patch Changes](#patch-changes-45)
+  - [v6.12.1](#v6121)
+    - [Patch Changes](#patch-changes-46)
   - [v6.12.0](#v6120)
     - [What's Changed](#whats-changed-13)
       - [`React.startTransition` support](#reactstarttransition-support)
     - [Minor Changes](#minor-changes-23)
-    - [Patch Changes](#patch-changes-46)
-  - [v6.11.2](#v6112)
     - [Patch Changes](#patch-changes-47)
-  - [v6.11.1](#v6111)
+  - [v6.11.2](#v6112)
     - [Patch Changes](#patch-changes-48)
+  - [v6.11.1](#v6111)
+    - [Patch Changes](#patch-changes-49)
   - [v6.11.0](#v6110)
     - [Minor Changes](#minor-changes-24)
-    - [Patch Changes](#patch-changes-49)
+    - [Patch Changes](#patch-changes-50)
   - [v6.10.0](#v6100)
     - [What's Changed](#whats-changed-14)
     - [Minor Changes](#minor-changes-25)
       - [`future.v7_normalizeFormMethod`](#futurev7_normalizeformmethod)
-    - [Patch Changes](#patch-changes-50)
+    - [Patch Changes](#patch-changes-51)
   - [v6.9.0](#v690)
     - [What's Changed](#whats-changed-15)
       - [`Component`/`ErrorBoundary` route properties](#componenterrorboundary-route-properties)
       - [Introducing Lazy Route Modules](#introducing-lazy-route-modules)
     - [Minor Changes](#minor-changes-26)
-    - [Patch Changes](#patch-changes-51)
-  - [v6.8.2](#v682)
     - [Patch Changes](#patch-changes-52)
-  - [v6.8.1](#v681)
+  - [v6.8.2](#v682)
     - [Patch Changes](#patch-changes-53)
+  - [v6.8.1](#v681)
+    - [Patch Changes](#patch-changes-54)
   - [v6.8.0](#v680)
     - [Minor Changes](#minor-changes-27)
-    - [Patch Changes](#patch-changes-54)
+    - [Patch Changes](#patch-changes-55)
   - [v6.7.0](#v670)
     - [Minor Changes](#minor-changes-28)
-    - [Patch Changes](#patch-changes-55)
-  - [v6.6.2](#v662)
     - [Patch Changes](#patch-changes-56)
-  - [v6.6.1](#v661)
+  - [v6.6.2](#v662)
     - [Patch Changes](#patch-changes-57)
+  - [v6.6.1](#v661)
+    - [Patch Changes](#patch-changes-58)
   - [v6.6.0](#v660)
     - [What's Changed](#whats-changed-16)
     - [Minor Changes](#minor-changes-29)
-    - [Patch Changes](#patch-changes-58)
+    - [Patch Changes](#patch-changes-59)
   - [v6.5.0](#v650)
     - [What's Changed](#whats-changed-17)
     - [Minor Changes](#minor-changes-30)
-    - [Patch Changes](#patch-changes-59)
-  - [v6.4.5](#v645)
     - [Patch Changes](#patch-changes-60)
-  - [v6.4.4](#v644)
+  - [v6.4.5](#v645)
     - [Patch Changes](#patch-changes-61)
-  - [v6.4.3](#v643)
+  - [v6.4.4](#v644)
     - [Patch Changes](#patch-changes-62)
-  - [v6.4.2](#v642)
+  - [v6.4.3](#v643)
     - [Patch Changes](#patch-changes-63)
-  - [v6.4.1](#v641)
+  - [v6.4.2](#v642)
     - [Patch Changes](#patch-changes-64)
+  - [v6.4.1](#v641)
+    - [Patch Changes](#patch-changes-65)
   - [v6.4.0](#v640)
     - [What's Changed](#whats-changed-18)
       - [Remix Data APIs](#remix-data-apis)
-    - [Patch Changes](#patch-changes-65)
+    - [Patch Changes](#patch-changes-66)
   - [v6.3.0](#v630)
     - [Minor Changes](#minor-changes-31)
   - [v6.2.2](#v622)
-    - [Patch Changes](#patch-changes-66)
-  - [v6.2.1](#v621)
     - [Patch Changes](#patch-changes-67)
+  - [v6.2.1](#v621)
+    - [Patch Changes](#patch-changes-68)
   - [v6.2.0](#v620)
     - [Minor Changes](#minor-changes-32)
-    - [Patch Changes](#patch-changes-68)
-  - [v6.1.1](#v611)
     - [Patch Changes](#patch-changes-69)
+  - [v6.1.1](#v611)
+    - [Patch Changes](#patch-changes-70)
   - [v6.1.0](#v610)
     - [Minor Changes](#minor-changes-33)
-    - [Patch Changes](#patch-changes-70)
-  - [v6.0.2](#v602)
     - [Patch Changes](#patch-changes-71)
-  - [v6.0.1](#v601)
+  - [v6.0.2](#v602)
     - [Patch Changes](#patch-changes-72)
+  - [v6.0.1](#v601)
+    - [Patch Changes](#patch-changes-73)
   - [v6.0.0](#v600)
 
 </details>
@@ -305,6 +309,36 @@ Date: YYYY-MM-DD
 **Full Changelog**: [`v7.X.Y...v7.X.Y`](https://github.com/remix-run/react-router/compare/[email protected]@7.X.Y)
 -->
 
+## v7.4.1
+
+Date: 2025-03-28
+
+### Security Notice
+
+Fixed a security vulnerability that allowed URL manipulation and potential cache pollution via the `Host` and `X-Forwarded-Host` headers due to inadequate port sanitization.
+
+### Patch Changes
+
+- `react-router` - Dedupe calls to `route.lazy` functions ([#13260](https://github.com/remix-run/react-router/pull/13260))
+- `@react-router/dev` - Fix path in prerender error messages ([#13257](https://github.com/remix-run/react-router/pull/13257))
+- `@react-router/dev` - Fix typegen for virtual modules when `moduleDetection` is set to `force` ([#13267](https://github.com/remix-run/react-router/pull/13267))
+- `@react-router/express` - Better validation of `x-forwarded-host` header to prevent potential security issues ([#13309](https://github.com/remix-run/react-router/pull/13309))
+
+### Unstable Changes
+
+⚠️ _[Unstable features](https://reactrouter.com/community/api-development-strategy#unstable-flags) are not recommended for production use_
+
+- `react-router` - Fix types on `unstable_MiddlewareFunction` to avoid type errors when a middleware doesn't return a value ([#13311](https://github.com/remix-run/react-router/pull/13311))
+- `react-router` - Add support for `route.unstable_lazyMiddleware` function to allow lazy loading of middleware logic ([#13210](https://github.com/remix-run/react-router/pull/13210))
+  - ⚠️ We do not recommend adoption of this API currently as we are likely going to change it prior to the stable release of middleware
+  - ⚠️ This may be a breaking change if your app is currently returning `unstable_middleware` from `route.lazy`
+  - The `route.unstable_middleware` property is no longer supported in the return value from `route.lazy`
+  - If you want to lazily load middleware, you must use `route.unstable_lazyMiddleware`
+- `@react-router/dev` - When both `future.unstable_middleware` and `future.unstable_splitRouteModules` are enabled, split `unstable_clientMiddleware` route exports into separate chunks when possible ([#13210](https://github.com/remix-run/react-router/pull/13210))
+- `@react-router/dev` - Improve performance of `future.unstable_middleware` by ensuring that route modules are only blocking during the middleware phase when the `unstable_clientMiddleware` has been defined ([#13210](https://github.com/remix-run/react-router/pull/13210))
+
+**Full Changelog**: [`v7.4.0...v7.4.1`](https://github.com/remix-run/react-router/compare/[email protected]@7.4.1)
+
 ## v7.4.0
 
 Date: 2025-03-19