fix(router-core): handle excessive parent relative links - #8018

Merged
Sheraff merged 1 commit into
mainfrom
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged

fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom
fix-router-core-below-zero-relative-links

Conversation

@Sheraff

@SheraffSheraff commented Aug 9, 2026•
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary by CodeRabbit

  • Bug Fixes

    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.

  • Tests

    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.

@nx-cloud

nx-cloudBot commented Aug 9, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

View your CI Pipeline Execution ↗ for commit 3de5c4c

CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗

☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC

@github-actions

github-actionsBot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

@coderabbitai

coderabbitaiBot commented Aug 9, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f

📥 Commits

Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.

📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough

Walkthrough

resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.

Changes

Root-relative path resolution

Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:schiller-manuel

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-router-core-below-zero-relative-links

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actionsBot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Bundle Size Benchmarks

  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history

The following scenarios have bundle-size changes compared with the baseline:

ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁

Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.

@pkg-pr-new

pkg-pr-newBot commented Aug 9, 2026

Copy link
Copy Markdown
More templates

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start

npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc

npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c

@codspeed-hq

codspeed-hqBot commented Aug 9, 2026•
edited
Loading

Copy link
Copy Markdown

Merging this PR will regress 0 benchmarks

⚠️Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks

Performance Changes

ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)

Open in CodSpeed

@Sheraff
Sheraff merged commit 5500fd3 into mainAug 9, 2026
26 checks passed
@Sheraff
Sheraff deleted the fix-router-core-below-zero-relative-links branch August 9, 2026 17:40
@coderabbitaicoderabbitaiBot mentioned this pull request Aug 9, 2026
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request Aug 18, 2026
Merged
4 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

package: react-routerpackage: router-core

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix(router-core): handle excessive parent relative links - #8018
Merged
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged
fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Conversation
@Sheraff
@SheraffSheraff
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Collaborator
Summary by CodeRabbit
  • Bug Fixes
    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.
  • Tests
    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.
@nx-cloud
nx-cloudBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
View your CI Pipeline Execution ↗ for commit 3de5c4c
CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗
☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
🚀 Changeset Version Preview
No changeset entries found. Merging this PR will not cause a version bump for any packages.
@coderabbitai
coderabbitaiBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f
📥 Commits
Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.
📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough
Walkthrough
resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.
Changes
Root-relative path resolution
Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers:schiller-manuel
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Commit unit tests in branch fix-router-core-below-zero-relative-links
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
Bundle Size Benchmarks
  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history
The following scenarios have bundle-size changes compared with the baseline:
ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁
Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.
@pkg-pr-new
pkg-pr-newBot
commented
Aug 9, 2026

Copy link


Copy Markdown

More templates
@tanstack/arktype-adapter
npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router
npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start
npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history
npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin
npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router
npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools
npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query
npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start
npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client
npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc
npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server
npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli
npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core
npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools
npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core
npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator
npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin
npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core
npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils
npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin
npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router
npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools
npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query
npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start
npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client
npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server
npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core
npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs
npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core
npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core
npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions
npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context
npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter
npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes
npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router
npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools
npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query
npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start
npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client
npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server
npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter
npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c
@codspeed-hq
codspeed-hqBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Merging this PR will regress 0 benchmarks
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,

which may affect the accuracy of the results.
Open the report in CodSpeed to investigate
⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks
Performance Changes
ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)
Open in CodSpeed
@Sheraff
Sheraff
merged commit 5500fd3
into
mainAug 9, 2026

26 checks passed

@Sheraff
Sheraff
deleted the

fix-router-core-below-zero-relative-links

branch
August 9, 2026 17:40
@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 9, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 18, 2026
 Merged

4 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package: react-routerpackage: router-core

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(router-core): handle excessive parent relative links - #8018
Merged
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged
fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Conversation
@Sheraff
@SheraffSheraff
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Collaborator
Summary by CodeRabbit
  • Bug Fixes
    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.
  • Tests
    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.
@nx-cloud
nx-cloudBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
View your CI Pipeline Execution ↗ for commit 3de5c4c
CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗
☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
🚀 Changeset Version Preview
No changeset entries found. Merging this PR will not cause a version bump for any packages.
@coderabbitai
coderabbitaiBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f
📥 Commits
Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.
📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough
Walkthrough
resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.
Changes
Root-relative path resolution
Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers:schiller-manuel
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Commit unit tests in branch fix-router-core-below-zero-relative-links
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
Bundle Size Benchmarks
  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history
The following scenarios have bundle-size changes compared with the baseline:
ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁
Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.
@pkg-pr-new
pkg-pr-newBot
commented
Aug 9, 2026

Copy link


Copy Markdown

More templates
@tanstack/arktype-adapter
npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router
npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start
npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history
npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin
npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router
npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools
npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query
npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start
npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client
npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc
npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server
npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli
npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core
npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools
npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core
npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator
npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin
npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core
npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils
npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin
npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router
npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools
npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query
npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start
npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client
npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server
npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core
npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs
npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core
npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core
npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions
npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context
npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter
npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes
npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router
npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools
npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query
npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start
npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client
npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server
npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter
npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c
@codspeed-hq
codspeed-hqBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Merging this PR will regress 0 benchmarks
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,

which may affect the accuracy of the results.
Open the report in CodSpeed to investigate
⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks
Performance Changes
ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)
Open in CodSpeed
@Sheraff
Sheraff
merged commit 5500fd3
into
mainAug 9, 2026

26 checks passed

@Sheraff
Sheraff
deleted the

fix-router-core-below-zero-relative-links

branch
August 9, 2026 17:40
@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 9, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 18, 2026
 Merged

4 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package: react-routerpackage: router-core

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(router-core): handle excessive parent relative links - #8018
Merged
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged
fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Conversation
@Sheraff
@SheraffSheraff
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Collaborator
Summary by CodeRabbit
  • Bug Fixes
    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.
  • Tests
    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.
@nx-cloud
nx-cloudBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
View your CI Pipeline Execution ↗ for commit 3de5c4c
CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗
☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
🚀 Changeset Version Preview
No changeset entries found. Merging this PR will not cause a version bump for any packages.
@coderabbitai
coderabbitaiBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f
📥 Commits
Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.
📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough
Walkthrough
resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.
Changes
Root-relative path resolution
Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers:schiller-manuel
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Commit unit tests in branch fix-router-core-below-zero-relative-links
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
Bundle Size Benchmarks
  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history
The following scenarios have bundle-size changes compared with the baseline:
ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁
Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.
@pkg-pr-new
pkg-pr-newBot
commented
Aug 9, 2026

Copy link


Copy Markdown

More templates
@tanstack/arktype-adapter
npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router
npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start
npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history
npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin
npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router
npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools
npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query
npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start
npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client
npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc
npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server
npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli
npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core
npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools
npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core
npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator
npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin
npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core
npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils
npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin
npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router
npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools
npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query
npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start
npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client
npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server
npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core
npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs
npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core
npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core
npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions
npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context
npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter
npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes
npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router
npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools
npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query
npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start
npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client
npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server
npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter
npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c
@codspeed-hq
codspeed-hqBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Merging this PR will regress 0 benchmarks
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,

which may affect the accuracy of the results.
Open the report in CodSpeed to investigate
⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks
Performance Changes
ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)
Open in CodSpeed
@Sheraff
Sheraff
merged commit 5500fd3
into
mainAug 9, 2026

26 checks passed

@Sheraff
Sheraff
deleted the

fix-router-core-below-zero-relative-links

branch
August 9, 2026 17:40
@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 9, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 18, 2026
 Merged

4 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package: react-routerpackage: router-core

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix(router-core): handle excessive parent relative links - #8018
Merged
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged
fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Conversation
@Sheraff
@SheraffSheraff
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Collaborator
Summary by CodeRabbit
  • Bug Fixes
    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.
  • Tests
    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.
@nx-cloud
nx-cloudBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
View your CI Pipeline Execution ↗ for commit 3de5c4c
CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗
☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
🚀 Changeset Version Preview
No changeset entries found. Merging this PR will not cause a version bump for any packages.
@coderabbitai
coderabbitaiBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f
📥 Commits
Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.
📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough
Walkthrough
resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.
Changes
Root-relative path resolution
Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers:schiller-manuel
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Commit unit tests in branch fix-router-core-below-zero-relative-links
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
Bundle Size Benchmarks
  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history
The following scenarios have bundle-size changes compared with the baseline:
ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁
Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.
@pkg-pr-new
pkg-pr-newBot
commented
Aug 9, 2026

Copy link


Copy Markdown

More templates
@tanstack/arktype-adapter
npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router
npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start
npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history
npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin
npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router
npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools
npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query
npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start
npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client
npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc
npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server
npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli
npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core
npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools
npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core
npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator
npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin
npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core
npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils
npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin
npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router
npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools
npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query
npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start
npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client
npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server
npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core
npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs
npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core
npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core
npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions
npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context
npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter
npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes
npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router
npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools
npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query
npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start
npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client
npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server
npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter
npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c
@codspeed-hq
codspeed-hqBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Merging this PR will regress 0 benchmarks
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,

which may affect the accuracy of the results.
Open the report in CodSpeed to investigate
⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks
Performance Changes
ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)
Open in CodSpeed
@Sheraff
Sheraff
merged commit 5500fd3
into
mainAug 9, 2026

26 checks passed

@Sheraff
Sheraff
deleted the

fix-router-core-below-zero-relative-links

branch
August 9, 2026 17:40
@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 9, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 18, 2026
 Merged

4 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package: react-routerpackage: router-core

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(router-core): handle excessive parent relative links - #8018
Merged
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged
fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Conversation
@Sheraff
@SheraffSheraff
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Collaborator
Summary by CodeRabbit
  • Bug Fixes
    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.
  • Tests
    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.
@nx-cloud
nx-cloudBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
View your CI Pipeline Execution ↗ for commit 3de5c4c
CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗
☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
🚀 Changeset Version Preview
No changeset entries found. Merging this PR will not cause a version bump for any packages.
@coderabbitai
coderabbitaiBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f
📥 Commits
Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.
📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough
Walkthrough
resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.
Changes
Root-relative path resolution
Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers:schiller-manuel
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Commit unit tests in branch fix-router-core-below-zero-relative-links
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
Bundle Size Benchmarks
  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history
The following scenarios have bundle-size changes compared with the baseline:
ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁
Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.
@pkg-pr-new
pkg-pr-newBot
commented
Aug 9, 2026

Copy link


Copy Markdown

More templates
@tanstack/arktype-adapter
npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router
npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start
npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history
npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin
npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router
npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools
npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query
npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start
npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client
npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc
npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server
npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli
npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core
npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools
npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core
npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator
npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin
npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core
npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils
npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin
npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router
npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools
npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query
npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start
npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client
npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server
npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core
npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs
npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core
npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core
npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions
npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context
npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter
npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes
npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router
npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools
npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query
npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start
npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client
npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server
npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter
npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c
@codspeed-hq
codspeed-hqBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Merging this PR will regress 0 benchmarks
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,

which may affect the accuracy of the results.
Open the report in CodSpeed to investigate
⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks
Performance Changes
ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)
Open in CodSpeed
@Sheraff
Sheraff
merged commit 5500fd3
into
mainAug 9, 2026

26 checks passed

@Sheraff
Sheraff
deleted the

fix-router-core-below-zero-relative-links

branch
August 9, 2026 17:40
@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 9, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 18, 2026
 Merged

4 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package: react-routerpackage: router-core

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(router-core): handle excessive parent relative links - #8018
Merged
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged
fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Conversation
@Sheraff
@SheraffSheraff
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Collaborator
Summary by CodeRabbit
  • Bug Fixes
    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.
  • Tests
    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.
@nx-cloud
nx-cloudBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
View your CI Pipeline Execution ↗ for commit 3de5c4c
CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗
☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
🚀 Changeset Version Preview
No changeset entries found. Merging this PR will not cause a version bump for any packages.
@coderabbitai
coderabbitaiBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f
📥 Commits
Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.
📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough
Walkthrough
resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.
Changes
Root-relative path resolution
Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers:schiller-manuel
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Commit unit tests in branch fix-router-core-below-zero-relative-links
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
Bundle Size Benchmarks
  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history
The following scenarios have bundle-size changes compared with the baseline:
ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁
Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.
@pkg-pr-new
pkg-pr-newBot
commented
Aug 9, 2026

Copy link


Copy Markdown

More templates
@tanstack/arktype-adapter
npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router
npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start
npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history
npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin
npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router
npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools
npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query
npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start
npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client
npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc
npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server
npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli
npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core
npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools
npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core
npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator
npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin
npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core
npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils
npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin
npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router
npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools
npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query
npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start
npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client
npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server
npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core
npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs
npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core
npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core
npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions
npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context
npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter
npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes
npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router
npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools
npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query
npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start
npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client
npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server
npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter
npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c
@codspeed-hq
codspeed-hqBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Merging this PR will regress 0 benchmarks
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,

which may affect the accuracy of the results.
Open the report in CodSpeed to investigate
⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks
Performance Changes
ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)
Open in CodSpeed
@Sheraff
Sheraff
merged commit 5500fd3
into
mainAug 9, 2026

26 checks passed

@Sheraff
Sheraff
deleted the

fix-router-core-below-zero-relative-links

branch
August 9, 2026 17:40
@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 9, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 18, 2026
 Merged

4 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package: react-routerpackage: router-core

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix(router-core): handle excessive parent relative links - #8018
Merged
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Aug 9, 2026
Merged
fix(router-core): handle excessive parent relative links#8018
Sheraff merged 1 commit into
mainfrom 
fix-router-core-below-zero-relative-links
Conversation
@Sheraff
@SheraffSheraff
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Collaborator
Summary by CodeRabbit
  • Bug Fixes
    • Improved relative path handling to keep navigation safely within the application root.
    • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.
  • Tests
    • Added regression coverage for root traversal and potentially unsafe-looking URL segments.
@nx-cloud
nx-cloudBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
View your CI Pipeline Execution ↗ for commit 3de5c4c
CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...✅ Succeeded12m 15sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded2m 18sView ↗
☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
🚀 Changeset Version Preview
No changeset entries found. Merging this PR will not cause a version bump for any packages.
@coderabbitai
coderabbitaiBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f
📥 Commits
Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.
📒 Files selected for processing (4)
  • packages/react-router/tests/link.test.tsx
  • packages/router-core/src/path.ts
  • packages/router-core/tests/build-location.test.ts
  • packages/router-core/tests/path.test.ts
📝 Walkthrough
Walkthrough
resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.
Changes
Root-relative path resolution
Layer / File(s)Summary
Path resolution normalization
packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts		resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation
packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx		Tests verify that over-root targets generate rooted pathname, href, and publicHref values.
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers:schiller-manuel
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Commit unit tests in branch fix-router-core-below-zero-relative-links
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
@github-actions
github-actionsBot
commented
Aug 9, 2026

Copy link


Copy Markdown

Contributor
Bundle Size Benchmarks
  • Commit: f015e413d436
  • Measured at: 2026-08-09T17:25:46.193Z
  • Baseline source: history:6f8f534bf3a8
  • Dashboard: bundle-size history
The following scenarios have bundle-size changes compared with the baseline:
ScenarioCurrent (gzip)Delta vs baselineInitial gzipRawBrotliTrend
react-router.minimal83.92 KiB+4 B (+0.00%)83.78 KiB262.68 KiB73.02 KiB██████▁▁▁▁▁▁
react-router.full87.43 KiB+3 B (+0.00%)87.29 KiB274.40 KiB76.04 KiB██████▁▁▁▁▁▁
solid-router.minimal33.24 KiB+3 B (+0.01%)33.12 KiB96.52 KiB30.00 KiB██████▁▁▁▁▁▁
solid-router.full38.07 KiB+5 B (+0.01%)37.94 KiB111.15 KiB34.28 KiB██████▁▁▁▁▁▁
vue-router.minimal49.53 KiB+1 B (+0.00%)49.40 KiB138.26 KiB44.63 KiB██████▁▁▁▁▁▁
vue-router.full55.10 KiB+1 B (+0.00%)54.98 KiB156.44 KiB49.64 KiB██████▁▁▁▁▁▁
react-start.full99.93 KiB+6 B (+0.01%)99.79 KiB314.61 KiB86.59 KiB██████▁▁▁▁▁▁
react-start.rsbuild.minimal100.07 KiB+2 B (+0.00%)99.90 KiB315.45 KiB86.30 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife100.47 KiB+4 B (+0.00%)100.31 KiB316.38 KiB86.67 KiB▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full103.39 KiB+4 B (+0.00%)103.22 KiB325.54 KiB89.08 KiB▂▂▁▁▃▃▃▃▆███
solid-start.minimal46.01 KiB+1 B (+0.00%)45.89 KiB137.57 KiB40.95 KiB██████▁▁▁▁▁▁
solid-start.deferred-hydration49.09 KiB+4 B (+0.01%)45.95 KiB145.04 KiB43.69 KiB██████▁▁▁▁▁▁
solid-start.full51.09 KiB+3 B (+0.01%)50.97 KiB152.96 KiB45.33 KiB██████▁▁▁▁▁▁
vue-start.minimal65.55 KiB+2 B (+0.00%)65.42 KiB189.08 KiB58.40 KiB██████▁▁▁▁▁▁
vue-start.full69.38 KiB+4 B (+0.01%)69.25 KiB201.36 KiB61.60 KiB██████▁▁▁▁▁▁
Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.
@pkg-pr-new
pkg-pr-newBot
commented
Aug 9, 2026

Copy link


Copy Markdown

More templates
@tanstack/arktype-adapter
npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router
npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start
npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history
npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin
npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router
npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools
npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query
npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start
npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client
npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc
npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server
npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli
npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core
npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools
npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core
npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator
npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin
npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core
npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils
npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin
npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router
npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools
npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query
npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start
npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client
npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server
npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core
npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs
npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core
npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core
npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions
npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context
npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter
npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes
npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router
npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools
npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query
npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start
npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client
npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server
npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter
npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c
@codspeed-hq
codspeed-hqBot
commented
Aug 9, 2026•

edited

Loading

Copy link


Copy Markdown

Merging this PR will regress 0 benchmarks
⚠️Different runtime environments detected
Some benchmarks with significant performance changes were compared across different runtime environments,

which may affect the accuracy of the results.
Open the report in CodSpeed to investigate
⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks
Performance Changes
ModeBenchmarkBASEHEADEfficiency
⚡Memorymem server error-paths not-found (vue)1,808.8 KB318.4 KB×5.7
👁Memorymem client navigation-churn (solid)568.4 KB636.6 KB-10.73%
👁Memorymem client interrupted-navigations (react)249.1 KB281.1 KB-11.38%
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)
Open in CodSpeed
@Sheraff
Sheraff
merged commit 5500fd3
into
mainAug 9, 2026

26 checks passed

@Sheraff
Sheraff
deleted the

fix-router-core-below-zero-relative-links

branch
August 9, 2026 17:40
@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 9, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 18, 2026
 Merged

4 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package: react-routerpackage: router-core

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff