Client-rendered React 19 admin SPA · 2026
Which React router do we ship?
Five angles, one console. The recommendation up top, the five sub-investigations as tiles below — each one drillable into its full page.
For a console where the URL carries filters, sorting and pagination, adopt TanStack Router ★ 15k — full type safety and schema-validated search params in pure SPA mode, no server required. React Router ★ 56k (now v8) is the defensible default if you value the largest ecosystem over typed search state. [3]
The admin console's real state — filters, sort, pagination — lives in the query string. TanStack validates it at the route boundary (validateSearch ✓), so deep links can't drift and reads come back typed and parsed.[6]
★ 15k · stable v1 since Dec 2023 · type-safe, state-first
URL → state → data → UI. Typed path + search params with zero config, identical whether you SSR or not. The one router that natively validates search-param state.[5]
★ 56k · v8, June 2026 · biggest ecosystem
URL → component. The incumbent, least migration friction, yearly cadence. But its typed params and typed href only fully materialise in framework mode.[4]
— evaluated for a deliberately client-rendered, auth-gated console —
The fact underneath all five angles: which mode?
React Router's headline features — typed path params, typed href, loader/action data — fully materialise only in framework mode: a server. Run it as a pure client SPA and you drop back to useLoaderData() as Post and untyped URLSearchParams. TanStack's typing is identical SSR or not — so for a client-rendered console the two are not evenly matched.[7]
The five angles
The 2026 candidate landscape
TanStack Router is the sharpest fit, React Router the safest default. Wouter ★ 7.9k is for simple apps; Next.js App Router is the wrong grain.
Typed search-param state
The decisive edge: only TanStack gives typed, schema-validated search params end to end in pure SPA mode — filters, sort, pagination checked at the type boundary.
Who owns the cache?
Let a query library own fetching, caching and invalidation; keep the router thin, priming at most. Framework loaders only pay off with SSR.
Standalone router, or meta-framework?
A standalone router on Vite is still a first-class 2026 choice. RSC and meta-frameworks solve problems an auth-gated internal console doesn't have.
Migration effort & lock-in
Already on React Router? Staying is near-drop-in. Greenfield? The churn math tilts to TanStack. Real lock-in is loaders + file-route conventions.
All five point the same way
Pick TanStack for URL-as-state, React Router for ecosystem safety — and in both cases keep the data layer out of the router. Migration stays cheap only if you follow that rule.
Open costs on the recommended pick
Advanced, complex types
TanStack leans on very advanced TypeScript inference with cryptic errors and a real learning curve — steepest if the team isn't TS-first.[14]
May 2026 npm compromise
A supply-chain attack put malicious versions across 42 @tanstack/* packages live on npm for ~20 minutes before recovery.[1]
Not TypeScript-first?
React Router (data mode) is the lower-ceremony choice — a gentler slope that trades typed search params for the largest ecosystem.[2]
Leaving is cheap if you avoid the coupling
A small SPA migrates React Router → TanStack in ~2–4 hours, and the two can coexist during the switch.[12] Staying put is near-drop-in: the v6→v7 codemod automated 85–90% of changes across 461 files with zero false positives, and v8's breaking changes were pre-adoptable behind future.* flags.[13][15]