v7.9.6 Breaking Change: When using a colon in navigation, must precede relative paths with `./`

[bfaulk96]

Reproduction

1. Navigate to https://stackblitz.com/edit/github-chzf5vkt
2. Click "Broken" (routing error occurs)
3. Refresh Stackblitz app
4. Click "Not Broken" (no routing error)

System Info

Note that while the following are what I'm running on my local machine, this bug is reproducible with any version of react-route at or above v7.9.6 (using react 18 or 19).

System:
  OS: macOS 26.1
  CPU: (10) arm64 Apple M1 Pro
  Memory: 275.95 MB / 16.00 GB
  Shell: 5.9 - /bin/zsh
Binaries:
  Node: 22.18.0
  npm: 11.5.2
  bun: 1.3.5
  Watchman: 2025.12.15.00
Browsers:
  Chrome: 143.0.7499.171
  Safari: 26.1
npmPackages:
  react-router: 7.9.6 => 7.9.6 
  vite: ^7.3.0 => 7.3.1

Used Package Manager

bun/npm

Expected Behavior

When calling navigate({ pathname: 'my-path:with-colon' }, { replace: true });, RR should navigate to that path relative to the current location (versions prior to 7.9.6 allowed this)

Actual Behavior

When calling navigate({ pathname: 'my-path:with-colon' }, { replace: true });, RR errors.
Must use navigate({ pathname: './my-path:with-colon' }, { replace: true }); to fix.

When running on my machine, I get:

Uncaught SecurityError: Failed to execute 'replaceState' on 'History': A history state object with URL 'my-path:with-colon' cannot be created in a document with origin 'http://localhost:3000' and URL 'http://localhost:3000/';

When running in stackblitz, I seem to get:

No routes matched location "with-colon" 

Unsure of why they are different, though locally my app is only client-side with Declarative routing, and the example is server side with framework routing.

[bfaulk96]

Example of the same exact setup working in v7.9.5: https://stackblitz.com/edit/github-chzf5vkt-5ofc8hkh

[0372hoanghoccode]

Hi @bfaulk96! 👋

I've created a PR to fix this issue: #14714

The fix modifies the absolute URL detection in
esolvePath()\ to only treat hierarchical URLs (\scheme://) and protocol-relative URLs (//) as absolute, allowing relative paths with colons like \my-path:with-colon\ to work without requiring a ./\ prefix.

All tests are passing and the behavior is now consistent with v7.9.5. Let me know if you have any questions!

[bfaulk96]

Wow, that was incredibly fast, especially for a first-time contributor! Thanks for this! 🫡

[brophdawg11]

I think we want to fix this a different way - opened #14718 to address this

[bfaulk96]

Whatever allows us to upgrade, especially since the disclosure of those recent CVEs :)

Thanks!!