From 4f060dd11cd8bedcba9e3ee96fce832bd987fe25 Mon Sep 17 00:00:00 2001
From: Morgan Carr <256248948+morgan-coded@users.noreply.github.com>
Date: Mon, 8 Jun 2026 15:36:41 -0500
Subject: [PATCH 1/2] Use ServerRouter nonce when nonce prop is not specified
 (#15170)

Co-authored-by: Matt Brophy <matt@brophy.org>
---
 docs/how-to/security.md                       |  14 +-
 ...-nonce-default-hydrate-fallback-scripts.md |   1 +
 .../__tests__/dom/scroll-restoration-test.tsx |  55 +++++++
 .../__tests__/dom/ssr/components-test.tsx     | 150 ++++++++++++++++++
 packages/react-router/lib/dom/lib.tsx         |   9 +-
 .../react-router/lib/dom/ssr/components.tsx   |  33 +++-
 packages/react-router/lib/dom/ssr/entry.ts    |   1 +
 .../lib/dom/ssr/errorBoundaries.tsx           |   3 +
 .../react-router/lib/dom/ssr/fallback.tsx     |   4 +
 packages/react-router/lib/dom/ssr/server.tsx  |   6 +-
 packages/react-router/lib/router/links.ts     |   4 +-
 11 files changed, 267 insertions(+), 13 deletions(-)
 create mode 100644 packages/react-router/.changes/patch.fix-nonce-default-hydrate-fallback-scripts.md

diff --git a/docs/how-to/security.md b/docs/how-to/security.md
index e629f3249b..d3ec9491d1 100644
--- a/docs/how-to/security.md
+++ b/docs/how-to/security.md
@@ -13,15 +13,17 @@ This is by no means a comprehensive guide, but React Router provides features to
 
 ## `Content-Security-Policy`
 
-If you are implementing a [Content-Security-Policy (CSP)][csp] in your application, specifically one using the `unsafe-inline` directive, you will need to specify a [`nonce`][nonce] attribute on the inline `<script>` elements rendered in your HTML. This must be specified on any API that generates inline scripts, including:
+If you are implementing a [Content-Security-Policy (CSP)][csp] in your application, specifically one using the `unsafe-inline` directive, you will need to specify a [`nonce`][nonce] attribute on the inline `<script>` elements rendered in your HTML.
 
-- [`<Scripts nonce>`][scripts] (`root.tsx`)
-- [`<ScrollRestoration nonce>`][scrollrestoration] (`root.tsx`)
-- [`<ServerRouter nonce>`][serverrouter] (`entry.server.tsx`)
-- [`renderToPipeableStream(..., { nonce })`][renderToPipeableStream] (`entry.server.tsx`)
-- [`renderToReadableStream(..., { nonce })`][renderToReadableStream] (`entry.server.tsx`)
+Add a nonce to these two spots in [`entry.server.tsx`][entryserver]:
+
+- The [`<ServerRouter nonce>`][serverrouter] prop
+  - This will be proxied along through React Context and used for other Framework Mode components that output `nonce`-aware elements, including [`<Scripts>`][scripts], [`<ScrollRestoration>`][scrollrestoration]
+  - If those components specify their own `nonce` prop, it will override the `ServerRouter` value
+- The `nonce` options of [`renderToPipeableStream`][renderToPipeableStream]/[`renderToReadableStream`][renderToReadableStream]
 
 [csp]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
+[entryserver]: ../api/framework-conventions/entry.server.tsx
 [nonce]: https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/nonce
 [renderToPipeableStream]: https://react.dev/reference/react-dom/server/renderToPipeableStream
 [renderToReadableStream]: https://react.dev/reference/react-dom/server/renderToReadableStream
diff --git a/packages/react-router/.changes/patch.fix-nonce-default-hydrate-fallback-scripts.md b/packages/react-router/.changes/patch.fix-nonce-default-hydrate-fallback-scripts.md
new file mode 100644
index 0000000000..62df49634f
--- /dev/null
+++ b/packages/react-router/.changes/patch.fix-nonce-default-hydrate-fallback-scripts.md
@@ -0,0 +1 @@
+Use the `ServerRouter` nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them.
diff --git a/packages/react-router/__tests__/dom/scroll-restoration-test.tsx b/packages/react-router/__tests__/dom/scroll-restoration-test.tsx
index 51e0ad438f..f6ee4113a3 100644
--- a/packages/react-router/__tests__/dom/scroll-restoration-test.tsx
+++ b/packages/react-router/__tests__/dom/scroll-restoration-test.tsx
@@ -233,6 +233,32 @@ describe(`ScrollRestoration`, () => {
       expect(script instanceof HTMLScriptElement).toBe(true);
     });
 
+    it("uses the FrameworkContext nonce when one is not provided", () => {
+      let router = createMemoryRouter([
+        {
+          id: "root",
+          path: "/",
+          element: (
+            <>
+              <Outlet />
+              <ScrollRestoration data-testid="scroll-script" />
+              <Scripts />
+            </>
+          ),
+        },
+      ]);
+
+      render(
+        <FrameworkContext.Provider
+          value={mockFrameworkContext({ nonce: "server-nonce" })}
+        >
+          <RouterProvider router={router} />
+        </FrameworkContext.Provider>,
+      );
+      let script = screen.getByTestId("scroll-script");
+      expect(script).toHaveAttribute("nonce", "server-nonce");
+    });
+
     it("should pass props to <script>", () => {
       let router = createMemoryRouter([
         {
@@ -261,6 +287,35 @@ describe(`ScrollRestoration`, () => {
       expect(script).toHaveAttribute("crossorigin", "anonymous");
     });
 
+    it("prefers an explicit nonce over the FrameworkContext nonce", () => {
+      let router = createMemoryRouter([
+        {
+          id: "root",
+          path: "/",
+          element: (
+            <>
+              <Outlet />
+              <ScrollRestoration
+                data-testid="scroll-script"
+                nonce="explicit-nonce"
+              />
+              <Scripts />
+            </>
+          ),
+        },
+      ]);
+
+      render(
+        <FrameworkContext.Provider
+          value={mockFrameworkContext({ nonce: "server-nonce" })}
+        >
+          <RouterProvider router={router} />
+        </FrameworkContext.Provider>,
+      );
+      let script = screen.getByTestId("scroll-script");
+      expect(script).toHaveAttribute("nonce", "explicit-nonce");
+    });
+
     it("should restore scroll position", () => {
       let scrollToMock = jest.spyOn(window, "scrollTo");
       let router = createMemoryRouter([
diff --git a/packages/react-router/__tests__/dom/ssr/components-test.tsx b/packages/react-router/__tests__/dom/ssr/components-test.tsx
index a26920631e..195ff19af0 100644
--- a/packages/react-router/__tests__/dom/ssr/components-test.tsx
+++ b/packages/react-router/__tests__/dom/ssr/components-test.tsx
@@ -291,6 +291,46 @@ describe("<HydratedRouter>", () => {
 });
 
 describe("<Links />", () => {
+  it("uses the FrameworkContext nonce when one is not provided", () => {
+    let context = mockFrameworkContext({
+      criticalCss: ".critical { color: red; }",
+      nonce: "server-nonce",
+    });
+
+    let { container } = render(
+      <DataRouterStateContext.Provider
+        value={{ matches: [], errors: null } as any}
+      >
+        <FrameworkContext.Provider value={context}>
+          <Links />
+        </FrameworkContext.Provider>
+      </DataRouterStateContext.Provider>,
+    );
+
+    let style = container.querySelector("style");
+    expect(style).toHaveAttribute("nonce", "server-nonce");
+  });
+
+  it("prefers an explicit nonce over the FrameworkContext nonce", () => {
+    let context = mockFrameworkContext({
+      criticalCss: ".critical { color: red; }",
+      nonce: "server-nonce",
+    });
+
+    let { container } = render(
+      <DataRouterStateContext.Provider
+        value={{ matches: [], errors: null } as any}
+      >
+        <FrameworkContext.Provider value={context}>
+          <Links nonce="explicit-nonce" />
+        </FrameworkContext.Provider>
+      </DataRouterStateContext.Provider>,
+    );
+
+    let style = container.querySelector("style");
+    expect(style).toHaveAttribute("nonce", "explicit-nonce");
+  });
+
   it("renders critical css with nonce", () => {
     let context = mockFrameworkContext({
       criticalCss: ".critical { color: red; }",
@@ -385,6 +425,60 @@ describe("<Links />", () => {
     let link = container.querySelector("link[href='/style.css']");
     expect(link).toHaveAttribute("nonce", "test-nonce");
   });
+
+  it("propagates the FrameworkContext nonce to route links", () => {
+    let context = mockFrameworkContext({
+      nonce: "server-nonce",
+      routeModules: {
+        root: {
+          default: () => null,
+          links: () => [{ rel: "stylesheet", href: "/style.css" }],
+        },
+      },
+      manifest: {
+        routes: {
+          root: {
+            id: "root",
+            module: "root.js",
+            hasLoader: false,
+            hasAction: false,
+            hasErrorBoundary: false,
+            hasClientAction: false,
+            hasClientLoader: false,
+            hasClientMiddleware: false,
+            clientActionModule: undefined,
+            clientLoaderModule: undefined,
+            clientMiddlewareModule: undefined,
+            hydrateFallbackModule: undefined,
+          },
+        },
+        entry: { imports: [], module: "" },
+        url: "",
+        version: "",
+      },
+    });
+
+    let { container } = render(
+      <DataRouterStateContext.Provider
+        value={
+          {
+            matches: [
+              {
+                route: { id: "root" },
+              },
+            ],
+          } as any
+        }
+      >
+        <FrameworkContext.Provider value={context}>
+          <Links />
+        </FrameworkContext.Provider>
+      </DataRouterStateContext.Provider>,
+    );
+
+    let link = container.querySelector("link[href='/style.css']");
+    expect(link).toHaveAttribute("nonce", "server-nonce");
+  });
 });
 
 describe("<Scripts />", () => {
@@ -463,6 +557,62 @@ describe("<Scripts />", () => {
       ),
     ).toHaveAttribute("nonce", "test-nonce");
   });
+
+  it("propagates the ServerRouter nonce to default HydrateFallback scripts when a route has a clientLoader without a HydrateFallback", async () => {
+    let staticHandlerContext = await createStaticHandler([{ path: "/" }]).query(
+      new Request("http://localhost/"),
+    );
+
+    invariant(
+      !(staticHandlerContext instanceof Response),
+      "Expected a context",
+    );
+
+    let context = mockEntryContext({
+      manifest: {
+        routes: {
+          root: {
+            // No server loader and a hydrating clientLoader with no
+            // HydrateFallback => the default HydrateFallback is rendered on the
+            // server, emitting `<Scripts>` (and a dev console script) inline.
+            hasLoader: false,
+            hasClientLoader: true,
+            hasAction: false,
+            hasErrorBoundary: false,
+            id: "root",
+            module: "root.js",
+            path: "/",
+          },
+        },
+        entry: {
+          imports: [],
+          module: "entry.js",
+        },
+        url: "manifest.js",
+        version: "",
+      },
+      routeModules: {
+        root: {
+          default: () => <h1>Root</h1>,
+          clientLoader: Object.assign(() => null, { hydrate: true as const }),
+        },
+      },
+    });
+
+    let { container } = render(
+      <ServerRouter
+        context={context}
+        url="http://localhost/"
+        nonce="test-nonce"
+      />,
+    );
+
+    let scripts = container.ownerDocument.querySelectorAll("script");
+    expect(scripts.length).toBeGreaterThan(0);
+    scripts.forEach((script) => {
+      expect(script).toHaveAttribute("nonce", "test-nonce");
+    });
+  });
 });
 
 describe("usePrefetchBehavior", () => {
diff --git a/packages/react-router/lib/dom/lib.tsx b/packages/react-router/lib/dom/lib.tsx
index cf27522181..d3d4d39601 100644
--- a/packages/react-router/lib/dom/lib.tsx
+++ b/packages/react-router/lib/dom/lib.tsx
@@ -2052,7 +2052,10 @@ export type ScrollRestorationProps = ScriptsProps & {
  * }
  * ```
  *
- * This component renders an inline `<script>` to prevent scroll flashing. The `nonce` prop will be passed down to the script tag to allow CSP nonce usage.
+ * This component renders an inline `<script>` to prevent scroll flashing. The
+ * `nonce` prop will be passed down to the script tag to allow CSP nonce usage.
+ * If not provided in Framework Mode, it will default to any
+ * {@link ServerRouter | `<ServerRouter nonce>`} prop.
  *
  * ```tsx
  * <ScrollRestoration nonce={cspNonce} />
@@ -2125,6 +2128,10 @@ export function ScrollRestoration({
     }
   }).toString();
 
+  if (props.nonce == null && remixContext?.nonce) {
+    props.nonce = remixContext.nonce;
+  }
+
   return (
     <script
       {...props}
diff --git a/packages/react-router/lib/dom/ssr/components.tsx b/packages/react-router/lib/dom/ssr/components.tsx
index c322141cd8..e1b13bea65 100644
--- a/packages/react-router/lib/dom/ssr/components.tsx
+++ b/packages/react-router/lib/dom/ssr/components.tsx
@@ -224,7 +224,8 @@ export interface LinksProps {
   /**
    * A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
    * attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
-   * element
+   * element. If not provided in Framework Mode, it will default to any
+   * {@link ServerRouter | `<ServerRouter nonce>`} prop.
    */
   nonce?: string | undefined;
   /**
@@ -265,8 +266,13 @@ export interface LinksProps {
  * tags
  */
 export function Links({ nonce, crossOrigin }: LinksProps): React.JSX.Element {
-  let { isSpaMode, manifest, routeModules, criticalCss } =
-    useFrameworkContext();
+  let {
+    isSpaMode,
+    manifest,
+    routeModules,
+    criticalCss,
+    nonce: contextNonce,
+  } = useFrameworkContext();
   let { errors, matches: routerMatches } = useDataRouterStateContext();
 
   let matches = getActiveMatches(routerMatches, errors, isSpaMode);
@@ -276,6 +282,10 @@ export function Links({ nonce, crossOrigin }: LinksProps): React.JSX.Element {
     [matches, routeModules, manifest],
   );
 
+  if (nonce == null && contextNonce) {
+    nonce = contextNonce;
+  }
+
   return (
     <>
       {typeof criticalCss === "string" ? (
@@ -344,6 +354,7 @@ export function Links({ nonce, crossOrigin }: LinksProps): React.JSX.Element {
  */
 export function PrefetchPageLinks({ page, ...linkProps }: PageLinkDescriptor) {
   let rsc = useIsRSCRouterContext();
+  let { nonce: contextNonce } = useFrameworkContext();
   let { router } = useDataRouterContext();
   let matches = React.useMemo(
     () => matchRoutes(router.routes, page, router.basename),
@@ -354,6 +365,10 @@ export function PrefetchPageLinks({ page, ...linkProps }: PageLinkDescriptor) {
     return null;
   }
 
+  if (linkProps.nonce == null && contextNonce) {
+    linkProps = { ...linkProps, nonce: contextNonce };
+  }
+
   if (rsc) {
     return (
       <RSCPrefetchPageLinksImpl page={page} matches={matches} {...linkProps} />
@@ -785,7 +800,8 @@ export type ScriptsProps = Omit<
   /**
    * A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
    * attribute to render on the [`<script>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script)
-   * element
+   * element. If not provided in Framework Mode, it will default to any
+   * {@link ServerRouter | `<ServerRouter nonce>`} prop.
    */
   nonce?: string | undefined;
 };
@@ -831,12 +847,21 @@ export function Scripts(scriptProps: ScriptsProps): React.JSX.Element | null {
     renderMeta,
     routeDiscovery,
     ssr,
+    nonce: contextNonce,
   } = useFrameworkContext();
   let { router, static: isStatic, staticContext } = useDataRouterContext();
   let { matches: routerMatches } = useDataRouterStateContext();
   let isRSCRouterContext = useIsRSCRouterContext();
   let enableFogOfWar = isFogOfWarEnabled(routeDiscovery, ssr);
 
+  // Fall back to the `nonce` provided via `FrameworkContext` (e.g. from
+  // `<ServerRouter nonce>`) when one isn't passed explicitly. This ensures the
+  // inline hydration scripts carry a nonce even when `<Scripts>` is rendered
+  // internally without props (such as in the default `HydrateFallback`).
+  if (scriptProps.nonce == null && contextNonce) {
+    scriptProps = { ...scriptProps, nonce: contextNonce };
+  }
+
   // Let <ServerRouter> know that we hydrated and we should render the single
   // fetch streaming scripts
   if (renderMeta) {
diff --git a/packages/react-router/lib/dom/ssr/entry.ts b/packages/react-router/lib/dom/ssr/entry.ts
index 8169141ca3..56671058b5 100644
--- a/packages/react-router/lib/dom/ssr/entry.ts
+++ b/packages/react-router/lib/dom/ssr/entry.ts
@@ -24,6 +24,7 @@ export interface FrameworkContextObject {
   ssr: boolean;
   isSpaMode: boolean;
   routeDiscovery: ServerBuild["routeDiscovery"];
+  nonce?: string;
   serializeError?(error: Error): SerializedError;
   renderMeta?: {
     didRenderScripts?: boolean;
diff --git a/packages/react-router/lib/dom/ssr/errorBoundaries.tsx b/packages/react-router/lib/dom/ssr/errorBoundaries.tsx
index 94cca1162f..100f4e0c47 100644
--- a/packages/react-router/lib/dom/ssr/errorBoundaries.tsx
+++ b/packages/react-router/lib/dom/ssr/errorBoundaries.tsx
@@ -77,10 +77,13 @@ export function RemixRootDefaultErrorBoundary({
   error: unknown;
   isOutsideRemixApp?: boolean;
 }) {
+  let { nonce } = useFrameworkContext();
+
   console.error(error);
 
   let heyDeveloper = (
     <script
+      nonce={nonce}
       dangerouslySetInnerHTML={{
         __html: `
         console.log(
diff --git a/packages/react-router/lib/dom/ssr/fallback.tsx b/packages/react-router/lib/dom/ssr/fallback.tsx
index 05abd6bc66..179e9a3df6 100644
--- a/packages/react-router/lib/dom/ssr/fallback.tsx
+++ b/packages/react-router/lib/dom/ssr/fallback.tsx
@@ -1,6 +1,7 @@
 import * as React from "react";
 
 import { BoundaryShell } from "./errorBoundaries";
+import { useFrameworkContext } from "./components";
 import { ENABLE_DEV_WARNINGS } from "../../context";
 
 // If the user sets `clientLoader.hydrate=true` somewhere but does not
@@ -8,10 +9,13 @@ import { ENABLE_DEV_WARNINGS } from "../../context";
 // least include `<Scripts>` in the SSR so we can hydrate the app and call the
 // `clientLoader` functions
 export function RemixRootDefaultHydrateFallback() {
+  let { nonce } = useFrameworkContext();
+
   return (
     <BoundaryShell title="Loading..." renderScripts>
       {ENABLE_DEV_WARNINGS ? (
         <script
+          nonce={nonce}
           dangerouslySetInnerHTML={{
             __html: `
               console.log(
diff --git a/packages/react-router/lib/dom/ssr/server.tsx b/packages/react-router/lib/dom/ssr/server.tsx
index 953f4a03a1..d1659a3f19 100644
--- a/packages/react-router/lib/dom/ssr/server.tsx
+++ b/packages/react-router/lib/dom/ssr/server.tsx
@@ -23,7 +23,10 @@ export interface ServerRouterProps {
   url: string | URL;
   /**
    * An optional `nonce` for [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP)
-   * compliance, used to allow inline scripts to run safely.
+   * compliance. This is applied to inline scripts rendered by React Router and
+   * used as the default for nonce-aware components such as {@link Links | `<Links>`},
+   * {@link Scripts | `<Scripts>`}, and {@link ScrollRestoration | `<ScrollRestoration>`}
+   * when they do not provide their own `nonce`.
    */
   nonce?: string;
 }
@@ -106,6 +109,7 @@ export function ServerRouter({
           ssr: context.ssr,
           isSpaMode: context.isSpaMode,
           routeDiscovery: context.routeDiscovery,
+          nonce,
           serializeError: context.serializeError,
           renderMeta: context.renderMeta,
         }}
diff --git a/packages/react-router/lib/router/links.ts b/packages/react-router/lib/router/links.ts
index dd99115c44..fdb9826846 100644
--- a/packages/react-router/lib/router/links.ts
+++ b/packages/react-router/lib/router/links.ts
@@ -186,7 +186,9 @@ export interface PageLinkDescriptor
   /**
    * A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
    * attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
-   * element
+   * element. If not provided in Framework Mode, it will default to any
+   * {@link ServerRouter | `<ServerRouter nonce>`} prop.
+
    */
   nonce?: string | undefined;
   /**

From 02ab7414b88ed215bac06de029956ee14b7d9119 Mon Sep 17 00:00:00 2001
From: Remix Run Bot <hello@remix.run>
Date: Mon, 8 Jun 2026 20:38:26 +0000
Subject: [PATCH 2/2] chore: generate markdown docs from jsdocs

---
 docs/api/components/Links.md               | 3 ++-
 docs/api/components/ScrollRestoration.md   | 8 ++++++--
 docs/api/framework-routers/ServerRouter.md | 5 ++++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/docs/api/components/Links.md b/docs/api/components/Links.md
index 9d4afbb5a6..23bbc98ae5 100644
--- a/docs/api/components/Links.md
+++ b/docs/api/components/Links.md
@@ -54,7 +54,8 @@ function Links({ nonce, crossOrigin }: LinksProps): React.JSX.Element
 
 A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
 attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
-element
+element. If not provided in Framework Mode, it will default to any
+``<ServerRouter nonce>`` prop.
 
 ### crossOrigin
 
diff --git a/docs/api/components/ScrollRestoration.md b/docs/api/components/ScrollRestoration.md
index 10e2b73de8..19ee559643 100644
--- a/docs/api/components/ScrollRestoration.md
+++ b/docs/api/components/ScrollRestoration.md
@@ -39,7 +39,10 @@ export default function Root() {
 }
 ```
 
-This component renders an inline `<script>` to prevent scroll flashing. The `nonce` prop will be passed down to the script tag to allow CSP nonce usage.
+This component renders an inline `<script>` to prevent scroll flashing. The
+`nonce` prop will be passed down to the script tag to allow CSP nonce usage.
+If not provided in Framework Mode, it will default to any
+[`<ServerRouter nonce>`](../framework-routers/ServerRouter) prop.
 
 ```tsx
 <ScrollRestoration nonce={cspNonce} />
@@ -80,7 +83,8 @@ that later navigations to prior paths will restore the scroll. Defaults to
 
 A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce)
 attribute to render on the [`<script>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script)
-element
+element. If not provided in Framework Mode, it will default to any
+``<ServerRouter nonce>`` prop.
 
 ### storageKey
 
diff --git a/docs/api/framework-routers/ServerRouter.md b/docs/api/framework-routers/ServerRouter.md
index 61e6d58a08..6a1bcbe3fa 100644
--- a/docs/api/framework-routers/ServerRouter.md
+++ b/docs/api/framework-routers/ServerRouter.md
@@ -46,7 +46,10 @@ needed for rendering.
 ### nonce
 
 An optional `nonce` for [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP)
-compliance, used to allow inline scripts to run safely.
+compliance. This is applied to inline scripts rendered by React Router and
+used as the default for nonce-aware components such as ``<Links>``,
+``<Scripts>``, and ``<ScrollRestoration>``
+when they do not provide their own `nonce`.
 
 ### url