Remix Newsletter #38

Happy New Year! We hope you were able to take some time off and enjoy your holidays with loved ones. The Remix team is recharged and ready for an exciting 2026. In this update, we recap the latest two minor versions of React Router, review everything we shipped in 2025, give a brief update on Remix 3 progress, showcase a production React Router RSC app, plus some Remix Store soft ware updates.

There's a lot to cover, so let's dive in 💿

React Router v7.11.0-v7.12.0

In React Router v7.11.0-v7.12.0 we've added support for vite preview, stabilized the client-side onError API, introduced call-site revalidation opt-out, enhanced CSRF protection, made several RSC improvements and fixed a number of bugs.

New Features

vite preview support: We've added support for vite preview when using Framework mode, making it easy to preview your production build locally before deploying.

Stabilized client-side onError: The unstable_onError APIs on <RouterProvider> and <HydratedRouter> have been stabilized as onError. If you've already adopted unstable_onError, you'll need to update your code accordingly. Check out the Error Reporting docs for more information.

Enhanced CSRF protection: We've added an additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins you can use the new allowedActionOrigins config field in react-router.config.ts to specify external origins.

Unstable Features

Call-site revalidation opt-out: We've added initial unstable support for call-site revalidation opt-out via a new unstable_defaultShouldRevalidate flag. This flag is available on all navigation and fetcher submission APIs to alter standard revalidation behavior. If any routes include a shouldRevalidate function, the flag value will be passed to that function so the route has the final say on revalidation behavior. This is particularly useful for cases like adding analytics search params that don't impact the UI.

RSC improvements: We've made several improvements to our React Server Components support, including support for throwing data() and Response from server component render phase, support for throwing redirect Response's at render time, routeRSCServerRequest API updates, manual chunking for react and react-router dependencies, and support for custom entrypoints in Framework mode.

Security Updates

We have released a number of CVEs identifying security vulnerabilities in React Router and Remix v2. We recommend updating to the latest appropriate versions:

• React Router v7 — 7.12.0
• React Router v6 — 6.30.3
• Remix v2 — 2.17.2

Please see the specific CVEs for more information on each vulnerability:

• XSS via Meta component when generating script:ld+json tags
• Unauthorized file access when using createFileSessionStorage() with unsigned cookies
• Unexpected external redirect via untrusted paths
• CSRF in React Router Action/Server Action Request Processing
• XSS via Open Redirects
• React Router SSR XSS in ScrollRestoration

Bug Fixes & Improvements

These releases include several bug fixes and improvements:

• Fix unstable_useTransitions prop on <Router> component to permit omission for backwards compatibility
• Allow redirects to be returned from client side middleware
• Handle dataStrategy implementations that return insufficient result sets by adding errors for routes without any available result
• Update compression and morgan dependencies to address on-headers CVE
• Fix generatePath when used with suffixed params (i.e., /books/:id.json)
• Escape HTML in scroll restoration keys
• Validate redirect locations
• Preserve clientLoader.hydrate=true when using <HydratedRouter unstable_instrumentations>
• Fix Maximum call stack size exceeded errors when HMR is triggered against code with cyclic imports
• Skip SSR middleware in vite preview server for SPA mode
• Add future.unstable_trailingSlashAwareDataRequests flag for consistent trailing slash handling in data requests
• Pass <Scripts nonce> value through to importmap script tags when using future.unstable_subResourceIntegrity
• Export UNSAFE_createMemoryHistory and UNSAFE_createHashHistory for migration support

Check out the full React Router changelog ↗

Remix Rewind 2025

The Remix team had one of our most productive and exciting years in 2025. We released a ton of new features in React Router, launched the Remix Store, restarted our conferences with Remix Jam, and shared the direction we're taking Remix. Here's a recap of what we shipped.

React Router v7

We kicked off the year with a freshly released React Router v7 (it shipped in late November 2024).

As you might recall, React Router v7 was our solution to two problems we had with the Remix project up to that point:

1. Remix and React Router were so similar that maintaining two projects unnecessarily split our user base and slowed our productivity
2. Our team as a whole was not entirely happy with some of the direction React had taken in the past few years, and felt like Remix either needed to conform to or compete with its core dependency

Our solution was to up-merge all of Remix v2's code into React Router (and call it Framework mode), making React Router v7 the next major version for both projects. Some folks didn't like this. They thought we made the wrong decision because "Remix is a cooler name for a project".

We actually agree, which is why we kept the name Remix for something else (see below) and started creating distance between the two projects.

Plus, React Router is a very clear name. It's a router for React. You do routing in React with React Router. That's what it's always been, that's what it'll always be, and we'll continue to support it and add new features for the foreseeable future.

In fact, in 2025 we shipped 37 releases (32 v7.x releases, 5 v6.x releases).

Setting aside the hundreds of bug fixes we shipped, here's a list of all the React Router features we shipped this year:

• Type-safe href
• Prerendering w/ a SPA Fallback
• SPA Mode root loader support
• Split Route Modules (future flag)
• Vite Environment API Support (future flag)
• Client Side context support
• Server- and Client-side Middleware (future flag)
• Sub-resource Integrity support (unstable future flag)
• Granular route.lazy object format
• routeDiscovery config option
• Automatic types for Future Flags
• Vite 7 support
• RSC support in Data and Framework mode (unstable)
• Client side onError handler
• fetcher.reset()
• Type-safe useRoute hook (unstable)
• Concurrent pre-rendering (unstable)
• Instrumentation APIs (unstable)
• Improved React 19 transition support (unstable)
• Call-site revalidation opt out (unstable)

We also switched to an Open Governance model for React Router. This has allowed us to better invite outside contributors to influence the roadmap through a well-defined RFC process and vote-based Steering Committee.

Beyond stabilizing the outstanding unstable features, this process has also given us a great list of additional features we plan to ship early this year:

• Consolidated useRouterState() hook (RFC)
• Typesafe fetcher alternatives (RFC)
• Contextual fetcher success/error handling (RFC)
• <Link rewrite> (RFC)

React Router is a great framework to build just about any website. In fact, we used it to build the...

Remix Store

On the community side, we launched the long-anticipated Remix Store.

This project is an open source React Router website built on Shopify.

We built the store to:

• Dogfood our own technology (look for that inevitable Remix 3 rewrite)
• Open source a non-trivial production website for the community to learn from
• Let people represent their favorite framework (or a hoodie they like from a framework they may or may not care about)

We're really proud of the merch we've created. One of the highlights of our year was seeing all the folks at Remix Jam sporting their Remix swag. Speaking of...

Remix Jam

We restarted our conferences!

We took a break after Remix Conf 2023, but we came back with Remix Jam, hosted in October at the Shopify Toronto offices.

In case you missed it, we put together a Remix Jam 2025 recap. One of the opening sentences summarizes it well:

People from all over the world joined us as we celebrated and shared the past, present, and future of Remix. This conference was an invitation to "our house" so we could open up "our garage" and jam. We invited some friends to first show you what they've been working on that's inspiring us, and then we had some "demo tapes" we wanted to spin as well.

The recordings are all linked in that blog post and up on our YouTube. We also gave the world the first taste of...

Remix 3

Remember how we said React Router v7 would be the next version of React Router and Remix? And how lots of people were upset and said we should have kept using the name Remix? Yeah, me too. Good times. Thanks for the feedback everyone.

Well, we reserved the name Remix to do something else. We shared a bit of that vision at the beginning of the summer in our blog post: "Wake up, Remix!". There we announced we were building a new framework (not built on React) based on the following six principles:

1. Model-First Development
2. Build on Web APIs
3. Religiously Runtime
4. Avoid Dependencies
5. Demand Composition
6. Distribute Cohesively

The majority of our development was public (just watch the repo). But at Remix Jam we got to show the world how we were putting all the pieces together, as well as a few things we'd been developing in secret.

We are building Remix to be a batteries-included, ultra-productive, zero dependencies and bundler-free framework, ready to develop with in a model-first world. Remix 3 is a reimagining of what a web framework can be; a fresh foundation shaped by decades of experience building for the web. Our focus is on simplicity, clarity, and performance, without giving up the power developers need.

Check out the Remix Jam talks and the repo if you want to learn more. Otherwise, we're excited to keep sharing more of...

Remix in 2026

While 2025 was a super productive year, and we're really proud of all we accomplished, there's so much more we're excited to ship in 2026.

We genuinely believe we're working on the best version of React Router ever. With the three modes (Declarative, Data, and Framework), React Router is flexible enough to be your simple client-side SPA router, your React-based full stack framework, and everything in between. Our new Open Governance model has driven even more engagement from outside contributors, and we're consistently shipping improvements people have been asking for years. In 2026 we plan to ship v8 and (likely in a minor update) stabilize our React Server Components/Functions support. React Router will give you access to all of React's features while letting you control how many you use.

While React Router remains our stable, battle-tested React-based framework, we're incredibly excited to also release another framework this year: Remix 3. If you've been following along or watched Ryan and Michael's talks at Remix Jam, you got a taste of what we're building: a batteries-included, ultra-productive, zero-dependency, bundler-free framework, ready for a model-first world. We've done a lot of the work already and are excited to release the packaged-up Remix framework in the near future. Get ready to npm i remix.

Oh, and we plan to have another conference. Keep a lookout for our Remix Jam 2026 announcement.

Remix 3 Progress

We've been hard at work rounding out the initial feature set for Remix 3. We aim to share a release candidate in the near future.

In the meantime, all of our work is public and we've been steadily releasing new packages and improving existing ones. Since Remix Jam, we've released the following packages:

• async-context-middleware: Middleware for storing request context in AsyncLocalStorage
• component: A minimal component system that leans on JavaScript and DOM primitives
• compression-middleware: Middleware for compressing HTTP responses
• cookie: A toolkit for working with cookies in JavaScript
• form-data-middleware: Middleware for parsing FormData from request bodies
• fs: Filesystem utilities using the Web File API
• html-template: HTML template tag with auto-escaping for JavaScript
• interaction: Like components but for events
• logger-middleware: Middleware for logging HTTP requests and responses
• method-override-middleware: Middleware for overriding HTTP request methods from form data
• mime: Utilities for dealing with MIME types
• response: Utilities for creating Responses
• session: Session management for JavaScript
• session-middleware: Middleware for managing sessions with cookie-based storage
• static-middleware: Middleware for serving static files from the filesystem

Each of these modules is single-purpose and useful for a variety of projects. When we release the Remix framework, you'll simply install the remix package and be ready to roll with a batteries-included, ultra-productive, zero dependencies and bundler-free framework, ready to develop with in a model-first world.

Check out the Remix repo ↗

AT Garden Club

Remix core team member Jacob Ebey recently launched AT Garden Club: "A CSS showcase styled by the AT Proto community."

This fun little project is quite possibly the first production site built with React Router RSC (experimental).

From the repo:

In 2003, Dave Shea began the legendary CSS Zen Garden project that demonstrated "what can be accomplished through CSS-based design" until submissions stopped in 2013. Stephanie Eckles rekindled that spirit with Style Stage by providing a modern base HTML for contributors to re-style by submitting alternate stylesheets.

AT Garden Club takes this vision further by decentralizing submissions through the AT Protocol, allowing submitters to completely own their data. Your creative work, your data, your control.

Modern CSS has given us incredible tools - Flexbox, Grid, custom variables, animations, and so much more. Join us to refresh your CSS skills, showcase your creativity, and learn from a community of passionate CSS practitioners!

Whether you want to see what a production React Router RSC project looks like or flex your CSS skills, we hope you find this project fun and educational.

Check out the repo to explore the code ↗

Remix Store Update

We have two exciting updates from the Remix Store.

First, we just dropped four new products. Head over to the store to check them out 🟢

Second, we're now offering free global shipping on all orders over $75 USD. We've heard from a lot of folks outside the US that shipping costs were a barrier, so we worked hard to make this happen.

Hope you enjoy the new products, wherever you are in the world.

Shop the Remix Store ↗

Connect at a Remix Meetup

Remix Meetups are run voluntarily by members of the community all around the globe with in-person and online options. These meetups feature local speakers, hackathons, workshops, and more!

Find a meetup near you ↗

No meetups near you? Reply to this email if you are interested in starting your own meetup. We've even created some guides to help you get started.

Starting a New Remix Meetup ↗

If you enjoy getting this email, please let us know! We'd love to hear from you, what you like about Remix and these updates, and any suggestions you have to improve them.

- The Remix Team