Remix Newsletter #43

Remix Jam tickets are on sale, React Router v8 is in pre-release, and Remix 3 betas just keep coming.

Let's hit it 🏎️

Remix Jam Early Bird Tickets

Remix Jam is back! We're meeting up again in Toronto on October 2 for our annual conference, and we hope you'll join us!

Tickets are just $399 $299 for a limited time.

The official speaker lineup is still coming, but expect plenty of talks showing off everything that is Remix: the framework, the modules, the ideas behind it, and the real apps people are building.

Get Remix Jam 2026 tickets ↗

React Router v7.15.1-v7.17.0

React Router v7.15.1-v7.17.0 fixes a few bugs, smooths the path to React Router v8, and introduces a shiny new experimental router state hook.

React Router CVEs

Before we dig into new features, we want to make you aware of 7 CVEs we have verified, fixed, and are now officially announcing. If you haven't already, we recommend updating to the latest version for the following packages:

• React Router v7: 7.17.0
• React Router v6: 6.30.4
• Remix v2: 2.17.5

These CVEs primarily affect Framework mode through narrow attack vectors, but all are worth addressing by updating your dependencies to the latest version:

• Potential CSRF via PUT/PATCH/DELETE document requests
• Potential RCE via 2-step attack chained onto existing prototype pollution vulnerability
• Same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
• DoS via unbounded path expansion in __manifest endpoint
• XSS in unstable RSC redirect handling via javascript: redirect targets
• Stored XSS via unescaped Location header in prerendered redirect HTML
• Denial of Service via reflected user input in single-fetch

Unstable Features

We've added a new experimental unstable_useRouterState() hook for Framework and Data Mode apps. It gives you one place to read active and pending router state, with values that overlap with today's hooks like useLocation, useSearchParams, useParams, useMatches, and useNavigation.

This should let you consolidate a bunch of hooks that will likely be marked deprecated later in v8 and potentially removed in an eventual v9.

Bug Fixes & Improvements

• Shipped a subset of the official docs inside react-router at node_modules/react-router/docs
• Stabilized future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests
• Logged future flag warnings for upcoming React Router v8 flags, fixed the warning URLs, and made sure each warning only logs once
• Fixed stale SSR data from serverLoader() when a client navigation aborts pending hydration before clientLoader resolves
• Fixed RouterProvider onError for synchronous initial loader errors in SPA mode
• Made useFetchers return a stable identity when fetchers have not changed
• Fixed custom window handling in browser URL creation
• Improved useNavigation() types so the discriminated union is preserved across navigation states
• Honored writable backpressure in @react-router/node stream helpers
• Normalized assetsBuildDirectory path separators in react-router-serve for Windows-built artifacts served on Linux
• Fixed basename conflicting with app directory name when Vite base is set

Check out the React Router changelog ↗

React Router v8 Pre-release

React Router v8.0.0-pre.0 is here!

React Router v8 is in pre-release mode, and we're looking for early beta testers to help us iron out any remaining issues before the stable release.

This is the first major release kicking off React Router's planned yearly major release cadence under the new Open Governance model.

What Changed

If you've already adopted the active v8 future flags in React Router v7, v8 should feel familiar. Those behaviors are now the default, and future.v8_splitRouteModules becomes a top-level splitRouteModules config option that is enabled by default.

The baseline also moves up to Node 22.12.0+, React 19.2.6+, and Vite 7+. React Router is now ESM-only, with TypeScript target/lib settings moved to ES2022.

How to Test the Pre-release

If you're still using react-router-dom, remove it and switch to react-router.

Upgrade your React Router packages to v8.0.0-pre.0, then remove your future.v8_* flags. Those behaviors are now the defaults.

Upgrade the relevant dependencies too:

• Node 22.12.0+
• React 19.2.6+
• Vite 7+

Other breaking changes should already have been marked as deprecated in v7, so follow those warnings and you should be good to go!

Read the React Router v8 pre-release changelog ↗

Remix 3 Beta Updates

Since the first Remix 3 beta, we've made significant improvements and squashed a bunch of bugs. You can check out the latest by installing remix@3.0.0-beta.3.

The latest updates tighten up the generated app shape around app/actions, improve remix doctor and remix routes, expand MiddlewareContext typing, and keep pushing the package toward clearer domain-based exports like remix/router, remix/routes, remix/middleware/auth, and remix/headers/*.

The result is a more cohesive beta: one remix package, better type flow from middleware to route handlers, fewer install friction points, stronger header and cookie utilities, more capable UI primitives for anchored and context menus, and a bunch more polish.

Start experimenting with npx remix@next new my-remix-app, or update an existing beta app to remix@3.0.0-beta.3. This is still pre-release software, so please share any bugs or rough edges you run into.

Read the remix@3.0.0-beta.3 release notes ↗

Connect at a Remix Meetup

Remix Meetups are run voluntarily by members of the community all around the globe with in-person and online options. These meetups feature local speakers, hackathons, workshops, and more!

Find a meetup near you ↗

No meetups near you? Reply to this email if you are interested in starting your own meetup. We've even created some guides to help you get started.

Starting a New Remix Meetup ↗

If you enjoy getting this email, please let us know! We'd love to hear from you, what you like about Remix and these updates, and any suggestions you have to improve them.

- The Remix Team