fix(security): upgrade Remix packages 2.1.0 → 2.17.4 by D-K-P · Pull Request #2951 · triggerdotdev/trigger.dev

D-K-P · 2026-01-27T15:12:54Z

Upgraded packages:

@remix-run/express: 2.1.0 → 2.17.4
@remix-run/node: 2.1.0 → 2.17.4
@remix-run/react: 2.1.0 → 2.17.4
@remix-run/router: 1.15.3 → 1.23.2
@remix-run/serve: 2.1.0 → 2.17.4
@remix-run/server-runtime: 2.1.0 → 2.17.4
@remix-run/dev: 2.1.0 → 2.17.4
@remix-run/eslint-config: 2.1.0 → 2.17.4
@remix-run/testing: 2.1.0 → 2.17.4

Also updated tar-fs override for new @remix-run/dev version.

Addresses CVE-2026-22029 (XSS via open redirects in loaders/actions). Upgraded packages: - @remix-run/express: 2.1.0 → 2.17.3 - @remix-run/node: 2.1.0 → 2.17.3 - @remix-run/react: 2.1.0 → 2.17.3 - @remix-run/router: 1.15.3 → 1.23.2 - @remix-run/serve: 2.1.0 → 2.17.3 - @remix-run/server-runtime: 2.1.0 → 2.17.3 - @remix-run/dev: 2.1.0 → 2.17.3 - @remix-run/eslint-config: 2.1.0 → 2.17.3 - @remix-run/testing: 2.1.0 → 2.17.3 Also updated tar-fs override for new @remix-run/dev version.

changeset-bot · 2026-01-27T15:12:58Z

⚠️ No Changeset found

Latest commit: 4c2bf66

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-01-27T15:13:27Z

Walkthrough

This pull request updates Remix packages in apps/webapp/package.json: @remix-run/express, @remix-run/node, @remix-run/react, @remix-run/serve, and @remix-run/server-runtime from 2.1.0 to 2.17.4; @remix-run/router from ^1.15.3 to ^1.23.2; and devDependencies @remix-run/dev, @remix-run/eslint-config, and @remix-run/testing to 2.17.4. The root package.json overrides were adjusted: @remix-run/dev's tar-fs mapping updated to 2.1.4, and testcontainers tar-fs mapping updated to 3.1.1.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is largely incomplete relative to the template; it lists upgraded packages but lacks testing steps, changelog entry, and unchecked checklist items.	Add Testing section describing steps taken, fill in Changelog section with change summary, and check/complete all checklist items as applicable.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title accurately summarizes the main change: upgrading Remix packages from 2.1.0 to 2.17.4, which is the primary modification in the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@package.json`:
- Line 89: Update the tar-fs override in package.json to patch CVE-2025-59343:
change the override entry for "@remix-run/dev@2.17.3>tar-fs" from "2.1.3" to
"2.1.4" (or any later 2.1.x) so the dependency used by `@remix-run/dev`@2.17.3
picks up the fixed version.

📜 Review details

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between eeab6bd and 4ef0cba.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

apps/webapp/package.json
package.json

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{js,ts,jsx,tsx,json,md,yaml,yml}

📄 CodeRabbit inference engine (AGENTS.md)

Format code using Prettier before committing

Files:

apps/webapp/package.json
package.json

🧠 Learnings (4)

📓 Common learnings

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: .cursor/rules/webapp.mdc:0-0
Timestamp: 2025-11-27T16:26:58.661Z
Learning: Applies to apps/webapp/**/*.{ts,tsx} : Follow the Remix 2.1.0 and Express server conventions when updating the main trigger.dev webapp

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-11-27T16:26:37.432Z
Learning: The webapp at apps/webapp is a Remix 2.1 application using Node.js v20

📚 Learning: 2025-11-27T16:26:37.432Z

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-11-27T16:26:37.432Z
Learning: The webapp at apps/webapp is a Remix 2.1 application using Node.js v20

Applied to files:

apps/webapp/package.json
package.json

📚 Learning: 2025-11-27T16:26:58.661Z

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: .cursor/rules/webapp.mdc:0-0
Timestamp: 2025-11-27T16:26:58.661Z
Learning: Applies to apps/webapp/**/*.{ts,tsx} : Follow the Remix 2.1.0 and Express server conventions when updating the main trigger.dev webapp

Applied to files:

apps/webapp/package.json
package.json

📚 Learning: 2026-01-15T11:50:06.067Z

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-15T11:50:06.067Z
Learning: Applies to {packages,integrations}/**/* : Add a changeset when modifying any public package in `packages/*` or `integrations/*` using `pnpm run changeset:add`

Applied to files:

package.json

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (21)

GitHub Check: units / internal / 🧪 Unit Tests: Internal (4, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (6, 8)
GitHub Check: units / internal / 🧪 Unit Tests: Internal (6, 8)
GitHub Check: units / packages / 🧪 Unit Tests: Packages (1, 1)
GitHub Check: units / internal / 🧪 Unit Tests: Internal (5, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (8, 8)
GitHub Check: units / internal / 🧪 Unit Tests: Internal (1, 8)
GitHub Check: units / internal / 🧪 Unit Tests: Internal (2, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (3, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (1, 8)
GitHub Check: units / internal / 🧪 Unit Tests: Internal (8, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (2, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (7, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (4, 8)
GitHub Check: units / internal / 🧪 Unit Tests: Internal (7, 8)
GitHub Check: units / internal / 🧪 Unit Tests: Internal (3, 8)
GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (5, 8)
GitHub Check: e2e / 🧪 CLI v3 tests (ubuntu-latest - pnpm)
GitHub Check: e2e / 🧪 CLI v3 tests (windows-latest - npm)
GitHub Check: e2e / 🧪 CLI v3 tests (windows-latest - pnpm)
GitHub Check: typecheck / typecheck

🔇 Additional comments (2)

apps/webapp/package.json (2)
231-233: No action required — all peer dependencies for Remix 2.17.3 are compatible.
The upgrade to @remix-run/dev, @remix-run/eslint-config, and @remix-run/testing 2.17.3 is compatible with the current tooling stack: TypeScript 5.5.4 (satisfies ^5.1.0), Vite ^5.4.21 (satisfies ^5.1.0 || ^6.0.0), ESLint ^8.24.0 (satisfies ^8.0.0), and React 18.x. No peer dependency conflicts or config changes are needed.
103-108: CVE-2026-22029 fix is included; remove Single Fetch breaking changes concern.
The upgrade to 2.17.3 safely includes the @remix-run/router 1.23.2+ fix for CVE-2026-22029 (XSS in redirect handling). Single Fetch is not enabled in remix.config.js, so the breaking changes mentioned do not apply—loaders/actions/redirect handling remains stable. However, audit redirect patterns using untrusted sources (e.g., submission.value.redirectUrl in resource routes) to ensure they don't accept arbitrary user-provided URLs that could exploit the XSS before the patched version was deployed.

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional flags.

vibe-kanban-cloud · 2026-01-28T13:37:20Z

Review Complete

Your review story is ready!

View Story

Comment !reviewfast on this PR to re-generate the story.

@ericallam

## Summary Upgrades all `@remix-run/*` packages in `apps/webapp` from **2.1.0 → 2.17.4** to address security vulnerabilities. Recreation of #2951 on a fresh checkout of `main`. **Updated packages (`apps/webapp/package.json`):** - `@remix-run/express`, `@remix-run/node`, `@remix-run/react`, `@remix-run/serve`, `@remix-run/server-runtime`: 2.1.0 → 2.17.4 - `@remix-run/router`: ^1.15.3 → ^1.23.2 - `@remix-run/dev`, `@remix-run/eslint-config`, `@remix-run/testing`: 2.1.0 → 2.17.4 **Root `package.json` overrides:** - `@remix-run/dev@2.17.4>tar-fs`: 2.1.3 → 2.1.4 - `testcontainers@10.28.0>tar-fs`: 3.0.9 → 3.1.1 **Documentation:** Updated Remix version references in `CLAUDE.md`, `apps/webapp/CLAUDE.md`, and `.cursor/rules/webapp.mdc`. **Server changes:** Added `.server-changes/upgrade-remix-security.md` for release tracking per `CONTRIBUTING.md`. No application code changes — only `package.json` files, documentation, a server-changes entry, and the regenerated `pnpm-lock.yaml`. ### Updates since last revision Addressed all 3 Devin Review findings: 1. **Missing `.server-changes/` file** — added `.server-changes/upgrade-remix-security.md` (commit ce22a0b) 2. **Sentry Remix patch (`@sentry/remix@9.46.0`)** — verified the patch at `patches/@sentry__remix@9.46.0.patch` applies cleanly against 2.17.4. The patch modifies Sentry's own `RemixInstrumentation` wrapper (removing `request.clone()` and form data attributes), not Remix internals. The underlying Remix APIs it hooks into (`callRouteAction`, `callRouteLoader`) are stable across 2.1→2.17. 3. **`remix-typedjson@0.3.1` compatibility** — peer deps declare `@remix-run/react: ^1.16.0 || ^2.0`, covering 2.17.4. Confirmed working at runtime across all 22 tested pages that use it (root.tsx, hooks, route loaders). ### Verification performed during this session - **Runtime:** Express+Remix integration, magic link login, client-side routing, MetaFunction rendering - **Operational:** hello-world task triggered via API, runs list, run detail, tasks page - **Comprehensive UI:** 22 pages, 11 filter types, environment/project switchers, interactive elements - **Docker:** Production Dockerfile (`docker/webapp/Dockerfile`) builds successfully - **Changelog audit:** All 16 minor versions reviewed — every breaking change is behind opt-in future flags the webapp doesn't enable ## Review & Testing Checklist for Human - [ ] **Verify auth flows in staging** — `remix-auth`, `remix-auth-email-link`, and `remix-auth-github` declare peer deps on `@remix-run/server-runtime@^1.x`, which is now 2.17.4. Login (magic link + OAuth) should be tested in a staging environment since local dev testing may not exercise all auth code paths. - [ ] **Verify tar-fs override versions** resolve the targeted security advisories (2.1.4 and 3.1.1) - [ ] **Review new transitive dependencies** added by the upgrade: `turbo-stream@2.4.1`, `undici@6.25.0`, `valibot@1.3.1`, `ws@7.5.10` Recommended test plan: deploy to staging and exercise core webapp flows — login (email magic link + GitHub OAuth), dashboard navigation, task triggering/viewing, and API endpoints — to catch runtime regressions not covered by local testing. ### Notes - Peer dependency warnings for `remix-auth-*` packages (expecting `@remix-run/server-runtime@^1.x`) were present in the original PR #2951 as well and appear to be pre-existing - The lockfile diff is large (~1200 lines) but mechanical — driven by the Remix version bump cascading through transitive dependencies - CI failures (`audit`, `units/internal/1-of-8`) are unrelated: `audit` is a `claude-code-action` bot permissions issue; the internal test failure is a ClickHouse testcontainers `Failed to connect to Reaper` flake Link to Devin session: https://app.devin.ai/sessions/d9fa9953b9bf40e5a8d12b8f5ba5b86b Requested by: @ericallam --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Eric Allam <eallam@icloud.com>

nicktrn · 2026-04-27T12:24:14Z

Superseded by #3372

coderabbitaiBot reviewed Jan 27, 2026
View reviewed changes

Comment threadpackage.json Outdated

nicktrn added 3 commits January 27, 2026 16:52

fix(security): upgrade tar-fs overrides to patchCVE-2025-59343
5b853a8

Merge branch 'main' into fix/security-remix-upgrade
54e7aa4

fix(security): bump Remix to 2.17.4 for react-routerCVE-2025-68470
59bfbf7

nicktrn changed the title ~~fix(security): upgrade Remix packages 2.1.0 → 2.17.3~~fix(security): upgrade Remix packages 2.1.0 → 2.17.4Jan 27, 2026

Merge branch 'main' into fix/security-remix-upgrade
4c2bf66

nicktrn marked this pull request as ready for review January 27, 2026 19:39

devin-ai-integrationBot reviewed Jan 27, 2026
View reviewed changes

This was referenced Apr 14, 2026
fix(security): upgrade Remix packages 2.1.0 → 2.17.4 #3371
Closed
fix(security): upgrade Remix packages 2.1.0 → 2.17.4 #3372
Merged

nicktrn closed this Apr 27, 2026

nicktrn deleted the fix/security-remix-upgrade branch June 3, 2026 13:27

Navigation Menu

Uh oh!

Uh oh!

fix(security): upgrade Remix packages 2.1.0 → 2.17.4 - #2951

fix(security): upgrade Remix packages 2.1.0 → 2.17.4#2951
D-K-P wants to merge 5 commits into
mainfrom
fix/security-remix-upgrade

D-K-P commented Jan 27, 2026•
edited by devin-ai-integration Bot
Loading

Uh oh!

changeset-botBot commented Jan 27, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Jan 27, 2026•
edited
Loading

Uh oh!

coderabbitaiBot left a comment

Uh oh!

Uh oh!

devin-ai-integrationBot left a comment

Uh oh!

vibe-kanban-cloudBot commented Jan 28, 2026

Uh oh!

nicktrn commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

D-K-P commented Jan 27, 2026• edited by devin-ai-integration BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-botBot commented Jan 27, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitaiBot commented Jan 27, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Uh oh!

coderabbitaiBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

devin-ai-integrationBot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

vibe-kanban-cloudBot commented Jan 28, 2026

Review Complete

Uh oh!

nicktrn commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

D-K-P commented Jan 27, 2026•
edited by devin-ai-integration Bot
Loading

changeset-botBot commented Jan 27, 2026•
edited
Loading

coderabbitaiBot commented Jan 27, 2026•
edited
Loading