fix(route): don't let a splat catchall match paths sharing its prefix

[chuenchen309]

Problem

get_route_regex compiles the splat catchall to a bare .* with no separator in front of it, while every other segment type prepends /. So posts/[[...splat]] becomes ^/posts.*/?$, which matches any path that merely starts with the literal text:

>>> from reflex.route import get_router
>>> router = get_router(["posts/[[...splat]]"])
>>> router("/posts")            # 'posts/[[...splat]]'  — correct
>>> router("/postsomething")    # 'posts/[[...splat]]'  — wrong
>>> router("/posts-archive")    # 'posts/[[...splat]]'  — wrong

Why the second two are wrong

Not a judgement call — the frontend disagrees with it. _embed_manifest_path_for (packages/reflex-base/src/reflex_base/plugins/embed.py:42-73) maps [[...splat]] to React Router's *, so the same route compiles to posts/*, which matches /posts and its descendants but not /postsomething. The Python router and the router that actually renders the page were answering differently for the same path.

Impact

app.router feeds get_load_events (app.py:1038), called per page load from state.py:2467, and app.py:1804 (self.app.router(path) or "404"). A path resolving to the wrong route means a different page's on_load events fire than the page that renders.

Fix

.* → (/.*)?, making the separator required while keeping the zero-segment case (/posts itself) matching.

I probed the other segment types against React Router's semantics before changing anything — single, optional, and index all already agree, so the catchall was the only divergence.

Tests

test_get_router_splat_catchall in tests/units/test_route.py, parameterized over both the matching and non-matching cases. Verified red before the fix (the two prefix cases fail, the three legitimate ones pass), green after.

uv run pytest tests/units → 4340 passed. uv run ruff check . / ruff format --check clean, uv run pyright reflex tests → 0 errors. (tests/units/istate/manager/test_expiration.py is flaky on main independently of this change — it fails ~2 runs in 5 on a pristine checkout.)

AI assistance

Written with Claude Code. I verified the repro, the React Router mapping, and the pre-existing flake myself rather than taking them on the model's word, and I'm responsible for the contents.

[greptile-apps]

Greptile Summary

This PR fixes a regex mismatch between the Python route matcher and the React Router frontend: [[...splat]] catchall segments were compiled to .* (no separator required), allowing posts/[[...splat]] to wrongly match /postsomething. The fix replaces .* with (/.*)?, enforcing a / separator while keeping the zero-segment case.

• reflex/route.py: One-line change in get_route_regex — .* → (/.*)? for DOUBLE_CATCHALL_SEGMENT, with an explanatory comment tying it back to React Router semantics.
• tests/units/test_route.py: Five-case parametrized test (test_get_router_splat_catchall) covering exact match, trailing slash, descendant path, and both prefix false-positive cases.

Confidence Score: 5/5

• Safe to merge — the change is a minimal, well-targeted regex correction with no side-effects on other route types.
• The one-line change is provably correct: (/.*)? enforces a / separator before the wildcard, exactly mirroring React Router's posts/* semantics. All three other segment types (SINGLE_SEGMENT, DOUBLE_SEGMENT, literal parts) are untouched. The new test covers both valid matches and the two prefix false-positives that triggered the bug.
• No files require special attention.

Important Files Changed

Filename	Overview
reflex/route.py	Changes .* to (/.*)? in the splat catchall regex branch so that posts/[[...splat]] no longer matches paths that merely share the prefix (e.g. /postsomething). The fix is correct and minimal.
tests/units/test_route.py	Adds test_get_router_splat_catchall with five parametrized cases covering the exact-match, descendant-match, and prefix-false-positive scenarios. Good coverage of the bug and fix.
news/6790.bugfix.md	New changelog entry describing the bug and the fix.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/splat-catch..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing chuenchen309:fix/splat-catchall-prefix-match (d02d837) with main (4116ff2)²}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (d8a132b) during the generation of this report, so 4116ff2 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩