@remix-run/ui

Navigations that specify a named frame that is not currently mounted now perform a document navigation instead of reloading the top frame. Fresh links, forms, and navigate() calls are left to the browser, preserving native form methods and bodies, while back and forward traversal reloads the destination document. Omit the target when the navigation should always reload the top frame:

The default resolveFrame now only fetches same-origin sources and follows same-origin redirects. Apps that load cross-origin frame content must provide a custom resolveFrame to run().

Raw HTML props now require an opaque value created by unsafeHTML(). This applies to innerHTML and both iframe srcDoc spellings (srcDoc and srcdoc). It prevents attacker-controlled prop spreads from activating HTML parsing with plain strings or JSON-shaped objects. outerHTML is not supported because it would replace a reconciler-owned element. unsafeHTML() is an explicit authorization boundary; it does not sanitize or otherwise modify its input.