fix(router-core): keep percent-encoded caret in paths to prevent an infinite redirect loop

[FrancoKaddour]

Closes #8041

The WHATWG URL path percent-encode set includes U+005E (^), but the PATH_UNSAFE_RE set introduced in #7695 didn't. decodeURI decodes %5E to a literal caret which nothing re-encodes, while browsers and the WHATWG URL parser always re-encode it — so the canonical publicHref built from the decoded pathname never matches the incoming raw href, and the server canonicalization redirect fires on every request: GET /%5E → 307 /^ → browser re-encodes → GET /%5E, forever.

Adding ^ to the preserved set makes the decode/encode round-trip stable, exactly like the other characters #7695 covered. Lowercase %5e normalizes to %5E in a single converging redirect, same as %7b → %7B today.

Tests follow the existing "WHATWG path percent-encode set preserved" suite; both fail without the one-character fix.

Summary by CodeRabbit

• Bug Fixes
  • Improved URL path handling by preserving percent-encoded caret characters.
  • Prevented potential infinite redirect loops caused by caret characters in paths.
  • Normalized lowercase caret encodings to uppercase %5E.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e938cc67-bb98-4b2e-814b-9e5466994196

📥 Commits

Reviewing files that changed from the base of the PR and between 7e93431 and 55c0e72.

📒 Files selected for processing (3)

• .changeset/caret-path-percent-encode.md
• packages/router-core/src/utils.ts
• packages/router-core/tests/utils.test.ts

---

📝 Walkthrough

Walkthrough

The router-core path sanitizer now percent-encodes caret characters. Tests verify preservation of encoded carets and uppercase normalization of lowercase escapes. A patch changeset documents the fix.

Changes

Caret path encoding

Layer / File(s)	Summary
Caret path sanitization and validation packages/router-core/src/utils.ts, packages/router-core/tests/utils.test.ts, .changeset/caret-path-percent-encode.md	PATH_UNSAFE_RE now includes ^. Tests verify preserved %5E encoding and normalization from lowercase %5e. The changeset records a patch release for @tanstack/router-core.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: package: router-core

Suggested reviewers: schiller-manuel, sheraff

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the router-core fix and its purpose of preventing infinite redirect loops caused by percent-encoded carets.
Linked Issues check	✅ Passed	The changes preserve percent-encoded carets and add tests, directly addressing issue #8041 and preventing the reported redirect loop.
Out of Scope Changes check	✅ Passed	The changes are limited to caret path sanitization, related tests, and the corresponding patch-release changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}