fix(security): upgrade Remix packages 2.1.0 → 2.17.4

.cursor/rules/webapp.mdc

@@ -4,7 +4,7 @@ globs: apps/webapp/**/*.tsx,apps/webapp/**/*.ts
 alwaysApply: false
 ---
 
-The main trigger.dev webapp, which powers it's API and dashboard and makes up the docker image that is produced as an OSS image, is a Remix 2.1.0 app that uses an express server, written in TypeScript. The following subsystems are either included in the webapp or are used by the webapp in another part of the monorepo:
+The main trigger.dev webapp, which powers it's API and dashboard and makes up the docker image that is produced as an OSS image, is a Remix 2.17.4 app that uses an express server, written in TypeScript. The following subsystems are either included in the webapp or are used by the webapp in another part of the monorepo:
 
 - `@trigger.dev/database` exports a Prisma 6.14.0 client that is used extensively in the webapp to access a PostgreSQL instance. The schema file is [schema.prisma](mdc:internal-packages/database/prisma/schema.prisma)
 - `@trigger.dev/core` is a published package and is used to share code between the `@trigger.dev/sdk` and the webapp. It includes functionality but also a load of Zod schemas for data validation. When importing from `@trigger.dev/core` in the webapp, we never import the root `@trigger.dev/core` path, instead we favor one of the subpath exports that you can find in [package.json](mdc:packages/core/package.json)

.server-changes/upgrade-remix-security.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Upgrade Remix packages from 2.1.0 to 2.17.4 to address security vulnerabilities in React Router

CLAUDE.md

@@ -92,7 +92,7 @@ User API call -> Webapp routes -> Services -> RunEngine -> Redis Queue -> Superv
 
 ### Apps
 
-- **apps/webapp**: Remix 2.1.0 app - main API, dashboard, orchestration. Uses Express server.
+- **apps/webapp**: Remix 2.17.4 app - main API, dashboard, orchestration. Uses Express server.
 - **apps/supervisor**: Manages task execution containers (Docker/Kubernetes).
 
 ### Public Packages

apps/webapp/CLAUDE.md

@@ -1,6 +1,6 @@
 # Webapp
 
-Remix 2.1.0 app serving as the main API, dashboard, and orchestration engine. Uses an Express server (`server.ts`).
+Remix 2.17.4 app serving as the main API, dashboard, and orchestration engine. Uses an Express server (`server.ts`).
 
 ## Verifying Changes
 

apps/webapp/package.json

@@ -104,12 +104,12 @@
     "@react-aria/datepicker": "^3.9.1",
     "@react-stately/datepicker": "^3.9.1",
     "@react-types/datepicker": "^3.7.1",
-    "@remix-run/express": "2.1.0",
-    "@remix-run/node": "2.1.0",
-    "@remix-run/react": "2.1.0",
-    "@remix-run/router": "^1.15.3",
-    "@remix-run/serve": "2.1.0",
-    "@remix-run/server-runtime": "2.1.0",
+    "@remix-run/express": "2.17.4",
+    "@remix-run/node": "2.17.4",
+    "@remix-run/react": "2.17.4",
+    "@remix-run/router": "^1.23.2",
+    "@remix-run/serve": "2.17.4",
+    "@remix-run/server-runtime": "2.17.4",
     "@remix-run/v1-meta": "^0.1.3",
     "@s2-dev/streamstore": "^0.22.5",
     "@sentry/remix": "9.46.0",
@@ -237,9 +237,9 @@
     "@internal/clickhouse": "workspace:*",
     "@internal/replication": "workspace:*",
     "@internal/testcontainers": "workspace:*",
-    "@remix-run/dev": "2.1.0",
-    "@remix-run/eslint-config": "2.1.0",
-    "@remix-run/testing": "^2.1.0",
+    "@remix-run/dev": "2.17.4",
+    "@remix-run/eslint-config": "2.17.4",
+    "@remix-run/testing": "^2.17.4",
     "@sentry/cli": "2.50.2",
     "@swc/core": "^1.3.4",
     "@swc/helpers": "^0.4.11",

package.json

@@ -89,8 +89,8 @@
       "typescript": "5.5.4",
       "@types/node": "20.14.14",
       "express@^4>body-parser": "1.20.3",
-      "@remix-run/dev@2.1.0>tar-fs": "2.1.3",
-      "testcontainers@10.28.0>tar-fs": "3.0.9",
+      "@remix-run/dev@2.17.4>tar-fs": "2.1.4",
+      "testcontainers@10.28.0>tar-fs": "3.1.1",
       "form-data@^2": "2.5.4",
       "form-data@^3": "3.0.4",
       "form-data@^4": "4.0.4",
@@ -120,4 +120,4 @@
       "turbo"
     ]
   }
-}
+}