@tanstack/react-router

1.170.44MIT

1.170.44 is the latest, published 12 October 2026.
2 security advisories, 1 with no fix yet.
1.x: 947 releases since 23 December 2023, 26 in the last 90 days.

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

No fixed version published yet · 1 advisory
- Malicious code in @tanstack/react-router (npm)MAL-2026-3465
Fixed in 1.169.9 · 1 advisory
- CRITICALMalware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysGHSA-g7cv-rxg3-hmpx

Releases in the last 90 days

Feed of releases and advisories

Every stable release, newest first. Notes are quoted as the maintainers published them.

1.170.44
12 October 2026
Updated dependencies:
Patch Changes
- Updated dependencies:
  @tanstack/router-core@1.171.37
1.170.43
12 October 2026
Updated dependencies:
Patch Changes
- Updated dependencies:
  @tanstack/router-core@1.171.36
1.170.42
10 October 2026
Updated dependencies:
Patch Changes
- reduce component nesting per route match
- Links of a route that the pending navigation leaves skip deriving the destination location, and clicks and preloads follow the href a Link displays. buildLocation now builds mask and routeMasks locations from the same _fromLocation as the destination.
- Fixed Link destinations that resolve to a route mask are now reused across navigations instead of being rebuilt every time. A mounted Link now follows changes to its href and reloadDocument props, and React Links no longer each subscribe to a hydration flag.
- Cancel pending link preload timers when starting navigation to avoid redundant preloading while the destination is loading.
- Updated dependencies:
  @tanstack/history@1.162.5
  @tanstack/router-core@1.171.35
1.170.41
30 September 2026
Updated dependencies:
Patch Changes
- Compose only enabled route boundaries instead of rendering inactive wrapper components.
- Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.
- Consolidate the root match context provider while preserving match context in the root shell.
- Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.
- Updated dependencies:
  @tanstack/router-core@1.171.34
1.170.40
27 September 2026
Updated dependencies:
Patch Changes
- Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.
- Updated dependencies:
  @tanstack/router-core@1.171.33
1.170.39
23 September 2026
Release notes
Patch Changes
- Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.
1.170.38
16 September 2026
Updated dependencies:
Patch Changes
- Updated dependencies:
  @tanstack/router-core@1.171.32
1.170.37
16 September 2026
Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.Static server functions decode cached RawStream values with the client deserializer plugins.SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.
Patch Changes
- deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.
- resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.
- Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.
  Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.
  Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.
  The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.
  The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.
  Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.
  Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.
  Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.
  Static server functions decode cached RawStream values with the client deserializer plugins.
  SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.
- useLinkProps no longer calls through an internal wrapper. The host element Link renders on is an @internal overload parameter that is stripped from the published declarations, so the public useLinkProps(options, forwardedRef?) signature is unchanged.
- Updated dependencies:
  @tanstack/router-core@1.171.31
1.170.36
13 September 2026
React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.
Patch Changes
- Keep the Link location cache out of server bundles: buildLocation only creates, reads and writes it when isServer is false. Render React Links on the server without the extra prop copies and the forwarded-ref hook. Link SSR rendering is 20-40% faster in the Link benchmarks and the React Start SSR request loop about 7% faster.
  React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.
  React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.
- Reuse hydration snapshot getters to avoid unnecessary store-instance effect updates when Links and other hydration-aware components rerender.
- Allow active and inactive Link props to override base element props in React and Solid while preserving class/style merging. Keep React's href, target, and disabled values controlled by routing options. Preserve Vue object and nested-array class bindings, including reactive updates and server rendering, without mutating cached bindings during VNode normalization.
- Make pathParamsAllowedCharacters initialization-only. Configure it when creating the router; changing allowed characters requires a new router instance. Remove decoder-update bookkeeping and decoder-change checks from route-owned path caches.
- Stop exporting the internal isPlainObject and isPlainArray helpers.
- Avoid a redundant prop copy when rendering native Links while preserving custom-component props and the public hook result.
- Reduce the bundle cost of shared Link pathname interpolation while preserving its rendering performance. Reuse one interpolation pass for pathname and optional metadata, keep the bounded cache on the router, and simplify React Link active-state and prop merging.
- Reuse built locations for Links whose destination does not depend on the current location. buildLocation keeps the result per options object when the build never read the current location, and the React Link passes one stable options object per instance, so navigations resolve unchanged Links with a lookup instead of a full build. The per-route pathname interpolation cache this replaces is removed. Link params, search and activeOptions are compared by value on render, so inline object literals with unchanged contents keep reusing the Link's location. Pass a new object to change a destination; like any other React prop, an object mutated in place is not re-read.
- Updated dependencies:
  @tanstack/router-core@1.171.30
  @tanstack/history@1.162.4
1.170.35
10 September 2026
Release notes
Patch Changes
- Upgrade TanStack Store to 0.11 and migrate router subscriptions to useSelector, preserving selector comparisons and Vue subscription cleanup.

Show 16 earlier releases

1.170.34
9 September 2026
Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.
Patch Changes
- Avoid allocating event-handler arrays and wrapper functions for links without user-supplied event handlers.
- Validate navigation and redirect destinations, keep ambiguous relative URLs on the current origin, and constrain prerender requests and output paths. Prevent redirect headers from appearing in serialized server function response bodies.
  Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.
  Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.
  Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.
  Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.
- React Links resolve state props without temporary class-name arrays or unnecessary style copies.
- Updated dependencies:
  @tanstack/router-core@1.171.29
  @tanstack/history@1.162.3
1.170.33
6 September 2026
When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.
Patch Changes
- Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.
- Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.
  When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.
- Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.
- Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.
- Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.
- Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.
- Updated dependencies:
  @tanstack/router-core@1.171.28
  @tanstack/history@1.162.2
1.170.32
22 August 2026
Updated dependencies:
Patch Changes
- preserve context during reloads
- Updated dependencies:
  @tanstack/router-core@1.171.27
1.170.31
19 August 2026
Updated dependencies:
Patch Changes
- Updated dependencies:
  @tanstack/router-core@1.171.26
1.170.30
18 August 2026
Updated dependencies:
Patch Changes
- preserve pending UI across retained routes
- direct export of CatchBoundary class component, remove function wrapper
- Updated dependencies:
  @tanstack/router-core@1.171.25
1.170.29
14 August 2026
Updated dependencies:
Patch Changes
- inline isCtrlKey inside Link component for byte shaving
- Updated dependencies:
  @tanstack/router-core@1.171.24
1.170.28
14 August 2026
Updated dependencies:
Patch Changes
- Avoid wrapping root components that may render the HTML document in a Suspense boundary during SSR and hydration.
- Reuse resolved lazy route components when revisiting code-split routes, preventing unnecessary pending UI.
- Updated dependencies:
  @tanstack/router-core@1.171.23
1.170.27
12 August 2026
Release notes
Patch Changes
- useMatchRoute w/ React Compiler
1.170.26
12 August 2026
Updated dependencies:
Patch Changes
- Warn when an Outlet is rendered inside a pending, error, or not-found component.
- remove the undocumented Link isTransitioning state and data-transitioning attribute
- Apply preloadDelay to viewport link preloading and cancel pending preloads when links leave the viewport.
- Updated dependencies:
  @tanstack/router-core@1.171.22
1.170.25
9 August 2026
Updated dependencies:
Patch Changes
- Updated dependencies:
  @tanstack/router-core@1.171.21
1.170.24
9 August 2026
Updated dependencies:
Patch Changes
- Updated dependencies:
  @tanstack/router-core@1.171.20
1.170.23
7 August 2026
Release notes
Patch Changes
- bail out of Link re-renders when the resolved href and active state are unchanged
1.170.22
7 August 2026
Updated dependencies:
Patch Changes
- retain mounted UI during revalidation
- Updated dependencies:
  @tanstack/router-core@1.171.19
1.170.21
6 August 2026
RouterCore.getMatchedRoutes() now returns [matchedRoutes, rawParams, foundRoute] instead of an object.
Patch Changes
- Prevent a blank frame before zero-delay initial pending UI by using a component-scoped React transition for match publication. Pending timing, boundary selection, and rendered matches continue to come from the router core.
- createFileRoute does not rely on FileRoute class
- clean intersection observer options in link component
- Preserve path params in their raw string form while matching routes so structured values returned by params.parse produce stable match IDs and do not reuse stale loader data.
  RouterCore.getMatchedRoutes() now returns [matchedRoutes, rawParams, foundRoute] instead of an object.
- Updated dependencies:
  @tanstack/router-core@1.171.18
  @tanstack/history@1.162.1
1.170.20
5 August 2026
Updated dependencies:
Patch Changes
- Updated dependencies:
  @tanstack/router-core@1.171.17
1.170.19
4 August 2026
Removed / changed exported internals
Patch Changes
- Rewrite match loading around a lane-based scheduler that tracks each navigation, preload, and background reload as an ordered unit of work. This fixes pending/redirect/retry state leaking between overlapping navigations, restores correct SSR status codes for redirects, errors, and not-found responses, and closes hydration gaps where the client re-ran work the server had already completed.
  Invalidation now retires matching active preloads so older speculative loader results cannot become fresh cache data after invalidation.
  Route headers() now only runs on the server, matching the documented behavior — it is no longer invoked during client-side asset projection.
  The documented default gcTime and preloadGcTime now match the existing runtime default of 5 minutes (300_000).
  Removed / changed exported internals
  RouterState no longer includes loadedAt, isTransitioning, statusCode, or redirect. Use match.updatedAt in place of loadedAt; subscribe to router.state.status / router.state.isLoading in place of isTransitioning; server response status and redirect handling are now internal to the server loader and are no longer exposed on router.state.
  RouteMatch.fetchCount has been removed, with no replacement — it was purely informational.
  RouteMatch.status no longer includes 'redirected' (it remains 'pending' | 'success' | 'error' | 'notFound') — redirected matches are dropped from the match list instead of being rendered.
  RouteMatch.globalNotFound has been renamed and privatized to the internal _notFound field. Use match.status === 'notFound' instead.
  The exported React, Solid, and Vue Match components now accept routeId instead of matchId.
  The exported RouterStores adapter contract now uses route-keyed presentation stores: matchesId is replaced by ids, matchStores by byRoute, and getRouteMatchStore() by getMatchStore(). The separate loadedAt, isLoading, isTransitioning, statusCode, and redirect stores have been removed, along with the pending/cache stores and their setters. StoreConfig.init has also been removed. Read application-facing state from router.state; preload and cache coordination are now internal.
  Removed RouterCore members getMatch(), updateMatch(), cancelMatch(), and cancelMatches() — read matches from router.state.matches (e.g. router.state.matches.find((m) => m.id === id)); there is no replacement for mutating or cancelling an individual in-flight match from outside the router.
  Removed RouterCore.hasNotFoundMatch() — use router.state.matches.some((m) => m.status === 'notFound').
  Removed RouterCore.looseRoutesById — use routesById.
  Removed RouterCore.isPrerendering(), RouterCore.isViewTransitionTypesSupported, and RouterCore.viewTransitionPromise, with no replacement.
  Removed RouterCore.getParsedLocationHref() and RouterCore.clearExpiredCache(), with no replacement — expired cache entries are now reconciled automatically as part of match commit.
  Removed RouterCore.latestLoadPromise and RouterCore.beforeLoad(), with no replacement.
  RouterCore.commitLocationPromise and RouterCore.pendingBuiltLocation have been replaced by the internal _commitPromise and _pendingLocation fields.
  Removed the exported GetMatchFn and UpdateMatchFn types, along with the methods they typed.
  Removed the standalone getMatchedRoutes() export from @tanstack/router-core — use the router.getMatchedRoutes() instance method instead.
  RouterCore.loadRouteChunk() no longer accepts an array of component types as its second argument. One-argument usage is unchanged; the optional second argument is now 'errorComponent', 'notFoundComponent', or false for internal boundary loading.
  Removed Redirect.redirectHandled, which was internal redirect bookkeeping.
  MatchRoutesOpts.preload and MatchRoutesOpts.dest have been removed.
  StartTransitionFn is now (fn, expected) => Promise<boolean> (previously (fn) => void). This only affects custom framework adapters that implement startTransition.
- Updated dependencies:
  @tanstack/router-core@1.171.16

All 947 releases

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 15 October 2026. Releases and advisories last read 15 October 2026.

Know when your own dependencies move

Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.

See what Inlinr does All packages

Security advisories

Releases in the last 90 days

1.170.44

1.170.43

1.170.42

1.170.41

1.170.40

1.170.39

1.170.38

1.170.37

1.170.36

1.170.35

1.170.34

1.170.33

1.170.32

1.170.31

1.170.30

1.170.29

1.170.28

1.170.27

1.170.26

1.170.25

1.170.24

1.170.23

1.170.22

1.170.21

1.170.20

1.170.19

Quality and security signals

Works with

Same family

Know when your own dependencies move