chore(react-router): Update dependency react-router to v7.14.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
react-router (source)	7.12.0 → 7.14.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

remix-run/react-router (react-router)

v7.14.2

Compare Source

Patch Changes

• Remove the un-documented custom error serialization logic from the internal turbo-stream implementation. React Router only automatically handles serialization of Error and it's standard subtypes (SyntaxError, TypeError, etc.). ([aabf4a1)

• Properly handle parent middleware redirects during fetcher.load ([aabf4a1)

• Remove redundant Omit<RouterProviderProps, "flushSync"> from react-router/dom RouterProvider ([aabf4a1)

• Improved types for generatePath's param arg ([aabf4a1)

  Type errors when required params are omitted:

  // Before
  // Passes type checks, but throws at runtime 💥
  generatePath(":required", { required: null });
  
  // After
  generatePath(":required", { required: null });
  //                          ^^^^^^^^ Type 'null' is not assignable to type 'string'.ts(2322)

  Allow omission of optional params:

  // Before
  generatePath(":optional?", {});
  //                         ^^ Property 'optional' is missing in type '{}' but required in type '{ optional: string | null | undefined; }'.ts(2741)
  
  // After
  generatePath(":optional?", {});

  Allows extra keys:

  // Before
  generatePath(":a", { a: "1", b: "2" });
  //                           ^ Object literal may only specify known properties, and 'b' does not exist in type '{ a: string; }'.ts(2353)
  
  // After
  generatePath(":a", { a: "1", b: "2" });

v7.14.1

Compare Source

Patch Changes

• Fix a potential race condition that can occur when rendering a HydrateFallback and initial loaders land before the router.subscribe call happens in the RouterProvider layout effect
• Normalize double-slashes in redirect paths

v7.14.0

Compare Source

Patch Changes

• UNSTABLE RSC FRAMEWORK MODE BREAKING CHANGE - Existing route module exports remain unchanged from stable v7 non-RSC mode, but new exports are added for RSC mode. If you want to use RSC features, you will need to update your route modules to export the new annotations. (#​14901)

  If you are using RSC framework mode currently, you will need to update your route modules to the new conventions. The following route module components have their own mutually exclusive server component counterparts:

  Server Component Export	Client Component
  ServerComponent	default
  ServerErrorBoundary	ErrorBoundary
  ServerLayout	Layout
  ServerHydrateFallback	HydrateFallback

  If you were previously exporting a ServerComponent, your ErrorBoundary, Layout, and HydrateFallback were also server components. If you want to keep those as server components, you can rename them and prefix them with Server. If you were previously importing the implementations of those components from a client module, you can simply inline them.

  Example:

  Before

  import { ErrorBoundary as ClientErrorBoundary } from "./client";
  
  export function ServerComponent() {
    // ...
  }
  
  export function ErrorBoundary() {
    return <ClientErrorBoundary />;
  }
  
  export function Layout() {
    // ...
  }
  
  export function HydrateFallback() {
    // ...
  }

  After

  export function ServerComponent() {
    // ...
  }
  
  export function ErrorBoundary() {
    // previous implementation of ClientErrorBoundary, this is now a client component
  }
  
  export function ServerLayout() {
    // rename previous Layout export to ServerLayout to make it a server component
  }
  
  export function ServerHydrateFallback() {
    // rename previous HydrateFallback export to ServerHydrateFallback to make it a server component
  }

• rsc Link prefetch (#​14902)

• Remove recursion from turbo-stream v2 allowing for encoding / decoding of massive payloads. (#​14838)

• encodeViaTurboStream leaked memory via unremoved AbortSignal listener (#​14900)

v7.13.2

Compare Source

Patch Changes

• Fix clientLoader.hydrate when an ancestor route is also hydrating a clientLoader (#​14835)

• Fix type error when passing Framework Mode route components using Route.ComponentProps to createRoutesStub (#​14892)

• Fix percent encoding in relative path navigation (#​14786)

• Add future.unstable_passThroughRequests flag (#​14775)

  By default, React Router normalizes the request.url passed to your loader, action, and middleware functions by removing React Router's internal implementation details (.data suffixes, index + _routes query params).

  Enabling this flag removes that normalization and passes the raw HTTP request instance to your handlers. This provides a few benefits:

  • Reduces server-side overhead by eliminating multiple new Request() calls on the critical path
  • Allows you to distinguish document from data requests in your handlers base don the presence of a .data suffix (useful for observability purposes)

  If you were previously relying on the normalization of request.url, you can switch to use the new sibling unstable_url parameter which contains a URL instance representing the normalized location:

  // ❌ Before: you could assume there was no `.data` suffix in `request.url`
  export async function loader({ request }: Route.LoaderArgs) {
    let url = new URL(request.url);
    if (url.pathname === "/path") {
      // This check will fail with the flag enabled because the `.data` suffix will
      // exist on data requests
    }
  }
  
  // ✅ After: use `unstable_url` for normalized routing logic and `request.url`
  // for raw routing logic
  export async function loader({ request, unstable_url }: Route.LoaderArgs) {
    if (unstable_url.pathname === "/path") {
      // This will always have the `.data` suffix stripped
    }
  
    // And now you can distinguish between document versus data requests
    let isDataRequest = new URL(request.url).pathname.endsWith(".data");
  }

• Internal refactor to consolidate framework-agnostic/React-specific route type layers - no public API changes (#​14765)

• Sync protocol validation to rsc flows (#​14882)

• Add a new unstable_url: URL parameter to route handler methods (loader, action, middleware, etc.) representing the normalized URL the application is navigating to or fetching, with React Router implementation details removed (.datasuffix, index/_routes query params) (#​14775)

  This is being added alongside the new future.unstable_passthroughRequests future flag so that users still have a way to access the normalized URL when that flag is enabled and non-normalized request's are being passed to your handlers. When adopting this flag, you will only need to start leveraging this new parameter if you are relying on the normalization of request.url in your application code.

  If you don't have the flag enabled, then unstable_url will match request.url.

v7.13.1

Compare Source

Patch Changes

• fix null reference exception in bad codepath leading to invalid route tree comparisons (#​14780)

• fix: clear timeout when turbo-stream encoding completes (#​14810)

• Improve error message when Origin header is invalid (#​14743)

• Fix matchPath optional params matching without a "/" separator. (#​14689)

  • matchPath("/users/:id?", "/usersblah") now returns null.
  • matchPath("/test_route/:part?", "/test_route_more") now returns null.

• add RSC unstable_getRequest (#​14758)

• Fix HydrateFallback rendering during initial lazy route discovery with matching splat route (#​14740)

• [UNSTABLE] Add support for <Link unstable_mask> in Data Mode which allows users to navigate to a URL in the router but "mask" the URL displayed in the browser. This is useful for contextual routing usages such as displaying an image in a model on top of a gallery, but displaying a browser URL directly to the image that can be shared and loaded without the contextual gallery in the background. (#​14716)

  // routes/gallery.tsx
  export function clientLoader({ request }: Route.LoaderArgs) {
    let sp = new URL(request.url).searchParams;
    return {
      images: getImages(),
      // When the router location has the image param, load the modal data
      modalImage: sp.has("image") ? getImage(sp.get("image")!) : null,
    };
  }
  
  export default function Gallery({ loaderData }: Route.ComponentProps) {
    return (
      <>
        <GalleryGrid>
          {loaderData.images.map((image) => (
            <Link
              key={image.id}
              {/* Navigate the router to /galley?image=N */}}
              to={`/gallery?image=${image.id}`}
              {/* But display /images/N in the URL bar */}}
              unstable_mask={`/images/${image.id}`}
            >
              <img src={image.url} alt={image.alt} />
            </Link>
          ))}
        </GalleryGrid>
  
        {/* When the modal data exists, display the modal */}
        {data.modalImage ? (
          <dialog open>
            <img src={data.modalImage.url} alt={data.modalImage.alt} />
          </dialog>
        ) : null}
      </>
    );
  }

  Notes:

  • The masked location, if present, will be available on useLocation().unstable_mask so you can detect whether you are currently masked or not.
  • Masked URLs only work for SPA use cases, and will be removed from history.state during SSR.
  • This provides a first-class API to mask URLs in Data Mode to achieve the same behavior you could do in Declarative Mode via manual backgroundLocation management.

• RSC: Update failed origin checks to return a 400 status and appropriate UI instead of a generic 500 (#​14755)

• Preserve query parameters and hash on manifest version mismatch reload (#​14813)

v7.13.0

Compare Source

Minor Changes

• Add crossOrigin prop to Links component (#​14687)

Patch Changes

• Fix double slash normalization for useNavigate colon urls (#​14718)
• Update failed origin checks to return a 400 status instead of a 500 (#​14737)
• Bugfix #​14666: Inline criticalCss is missing nonce (#​14691)
• Loosen allowedActionOrigins glob check so ** matches all domains (#​14722)

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • "before 7am on the first day of the week"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 5, 2026 4:56am

[changeset-bot]

⚠️ No Changeset found

Latest commit: 386612e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8457

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8457

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8457

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8457

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8457

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8457

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8457

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8457

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8457

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8457

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8457

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8457

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8457

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8457

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8457

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8457

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8457

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8457

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8457

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8457

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8457

commit: 386612e

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.