React Router Framework 8

Apply the Node.js 24, React 19, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover React Router 8 Framework Mode and were checked against 8.3.1. Apply the RSC section only when using its experimental RSC integration.

Keep react-router and the installed @react-router/* framework packages on one version in the lockfile and upgrade them together. React Router supports its 8.x and 7.x majors with security fixes. It has shipped each fix as a new release at the head of the affected major rather than as a patch to an older minor, and it can publish the advisory up to about a month after that release, so keep these packages on the newest 8.x release, even when that means a new minor, rather than waiting for an audit finding. react-router 8.3.1 declares React and react-dom >=19.2.7 as peers, and its development package accepts Vite 7 or 8. Use Node.js 24; the framework's declared Node minimum is 22.22.0, and its support policy covers Active LTS and the latest minor of Maintenance LTS. TypeScript 7 is supported by the 8.3.1 development package.

Route authorization and middleware

• Authenticate before every protected loader and action, either in covering ancestor server middleware or in the handler, and enforce tenant and object permissions at each data access. A parent loader, layout, or hidden component is not an authorization boundary for child handlers.
• Treat clientLoader, clientAction, and clientMiddleware as browser code. Protect their backend endpoints independently; browser checks before serverLoader() or serverAction() cannot