From 522a4f3cc4633de3bfe31829a255cc4d5e656c78 Mon Sep 17 00:00:00 2001
From: okxint <cashmein.eth@gmail.com>
Date: Fri, 24 Jul 2026 11:38:09 +0530
Subject: [PATCH 1/2] fix(router-plugin): escape single quotes in split route
 file paths

---
 packages/router-plugin/src/core/code-splitter/compilers.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/router-plugin/src/core/code-splitter/compilers.ts b/packages/router-plugin/src/core/code-splitter/compilers.ts
index 89cdae41ad..c9c4868821 100644
--- a/packages/router-plugin/src/core/code-splitter/compilers.ts
+++ b/packages/router-plugin/src/core/code-splitter/compilers.ts
@@ -623,7 +623,7 @@ export function compileCodeSplitReferenceRoute(
                         ) {
                           programPath.unshiftContainer('body', [
                             template.statement(
-                              `const ${splitNodeMeta.localImporterIdent} = () => import('${splitUrl}')`,
+                              `const ${splitNodeMeta.localImporterIdent} = () => import('${splitUrl.replace(/'/g, "\\'")}')`,
                             )(),
                           ])
                         }
@@ -719,7 +719,7 @@ export function compileCodeSplitReferenceRoute(
                         ) {
                           programPath.unshiftContainer('body', [
                             template.statement(
-                              `const ${splitNodeMeta.localImporterIdent} = () => import('${splitUrl}')`,
+                              `const ${splitNodeMeta.localImporterIdent} = () => import('${splitUrl.replace(/'/g, "\\'")}')`,
                             )(),
                           ])
                         }

From 7a75acfe9ea0e8c6387928604758f4cbfd171531 Mon Sep 17 00:00:00 2001
From: okxint <cashmein.eth@gmail.com>
Date: Thu, 30 Jul 2026 20:42:05 +0530
Subject: [PATCH 2/2] fix(start-server-core): return 406 instead of 500 for
 non-HTML Accept headers

When a request's Accept header doesn't include HTML or */*, the handler
correctly rejects it but was returning HTTP 500 (Server Error). Failed
content negotiation is a client-side condition; HTTP 406 Not Acceptable
is the correct status code for this case.

Fixes #7913
---
 packages/start-server-core/src/createStartHandler.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/start-server-core/src/createStartHandler.ts b/packages/start-server-core/src/createStartHandler.ts
index 90d4e706f9..847ed84b10 100644
--- a/packages/start-server-core/src/createStartHandler.ts
+++ b/packages/start-server-core/src/createStartHandler.ts
@@ -557,7 +557,7 @@ export function createStartHandler<TRegister = Register>(
           return normalizeSsrResponse(
             Response.json(
               { error: 'Only HTML requests are supported here' },
-              { status: 500 },
+              { status: 406 },
             ),
           )
         }