devin-ai-integration[bot]
7d82041809
## Summary
Upgrades all `@remix-run/*` packages in `apps/webapp` from **2.1.0 →
2.17.4** to address security vulnerabilities. Recreation of #2951 on a
fresh checkout of `main`.
**Updated packages (`apps/webapp/package.json`):**
- `@remix-run/express`, `@remix-run/node`, `@remix-run/react`,
`@remix-run/serve`, `@remix-run/server-runtime`: 2.1.0 → 2.17.4
- `@remix-run/router`: ^1.15.3 → ^1.23.2
- `@remix-run/dev`, `@remix-run/eslint-config`, `@remix-run/testing`:
2.1.0 → 2.17.4
**Root `package.json` overrides:**
- `@remix-run/dev@2.17.4>tar-fs`: 2.1.3 → 2.1.4
- `testcontainers@10.28.0>tar-fs`: 3.0.9 → 3.1.1
**Documentation:** Updated Remix version references in `CLAUDE.md`,
`apps/webapp/CLAUDE.md`, and `.cursor/rules/webapp.mdc`.
**Server changes:** Added `.server-changes/upgrade-remix-security.md`
for release tracking per `CONTRIBUTING.md`.
No application code changes — only `package.json` files, documentation,
a server-changes entry, and the regenerated `pnpm-lock.yaml`.
### Updates since last revision
Addressed all 3 Devin Review findings:
1. **Missing `.server-changes/` file** — added
`.server-changes/upgrade-remix-security.md` (commit ce22a0bd4)
2. **Sentry Remix patch (`@sentry/remix@9.46.0`)** — verified the patch
at `patches/@sentry__remix@9.46.0.patch` applies cleanly against 2.17.4.
The patch modifies Sentry's own `RemixInstrumentation` wrapper (removing
`request.clone()` and form data attributes), not Remix internals. The
underlying Remix APIs it hooks into (`callRouteAction`,
`callRouteLoader`) are stable across 2.1→2.17.
3. **`remix-typedjson@0.3.1` compatibility** — peer deps declare
`@remix-run/react: ^1.16.0 || ^2.0`, covering 2.17.4. Confirmed working
at runtime across all 22 tested pages that use it (root.tsx, hooks,
route loaders).
### Verification performed during this session
- **Runtime:** Express+Remix integration, magic link login, client-side
routing, MetaFunction rendering
- **Operational:** hello-world task triggered via API, runs list, run
detail, tasks page
- **Comprehensive UI:** 22 pages, 11 filter types, environment/project
switchers, interactive elements
- **Docker:** Production Dockerfile (`docker/webapp/Dockerfile`) builds
successfully
- **Changelog audit:** All 16 minor versions reviewed — every breaking
change is behind opt-in future flags the webapp doesn't enable
## Review & Testing Checklist for Human
- [ ] **Verify auth flows in staging** — `remix-auth`,
`remix-auth-email-link`, and `remix-auth-github` declare peer deps on
`@remix-run/server-runtime@^1.x`, which is now 2.17.4. Login (magic link
+ OAuth) should be tested in a staging environment since local dev
testing may not exercise all auth code paths.
- [ ] **Verify tar-fs override versions** resolve the targeted security
advisories (2.1.4 and 3.1.1)
- [ ] **Review new transitive dependencies** added by the upgrade:
`turbo-stream@2.4.1`, `undici@6.25.0`, `valibot@1.3.1`, `ws@7.5.10`
Recommended test plan: deploy to staging and exercise core webapp flows
— login (email magic link + GitHub OAuth), dashboard navigation, task
triggering/viewing, and API endpoints — to catch runtime regressions not
covered by local testing.
### Notes
- Peer dependency warnings for `remix-auth-*` packages (expecting
`@remix-run/server-runtime@^1.x`) were present in the original PR #2951
as well and appear to be pre-existing
- The lockfile diff is large (~1200 lines) but mechanical — driven by
the Remix version bump cascading through transitive dependencies
- CI failures (`audit`, `units/internal/1-of-8`) are unrelated: `audit`
is a `claude-code-action` bot permissions issue; the internal test
failure is a ClickHouse testcontainers `Failed to connect to Reaper`
flake
Link to Devin session:
https://app.devin.ai/sessions/d9fa9953b9bf40e5a8d12b8f5ba5b86b
Requested by: @ericallam
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Eric Allam <eallam@icloud.com>
124 lines
4.7 KiB
JSON
124 lines
4.7 KiB
JSON
{
|
|
"name": "triggerdotdev",
|
|
"private": true,
|
|
"workspaces": [
|
|
"apps/*",
|
|
"packages/*",
|
|
"integrations/*"
|
|
],
|
|
"version": "0.0.1",
|
|
"scripts": {
|
|
"build": "turbo run build",
|
|
"build:force": "turbo run build --force",
|
|
"build:db:seed": "turbo run build:db:seed",
|
|
"db:migrate": "turbo run db:migrate:deploy generate",
|
|
"db:seed": "turbo run db:seed",
|
|
"db:studio": "turbo run db:studio",
|
|
"db:populate": "turbo run db:populate",
|
|
"dev": "turbo run dev",
|
|
"i:dev": "infisical run -- turbo run dev",
|
|
"generate": "turbo run generate",
|
|
"lint": "turbo run lint",
|
|
"docker": "docker compose -p triggerdotdev-docker -f docker/docker-compose.yml up -d --build --remove-orphans",
|
|
"docker:stop": "docker compose -p triggerdotdev-docker -f docker/docker-compose.yml stop",
|
|
"dev:docker": "docker compose -p triggerdotdev-dev-docker -f docker/dev-compose.yml up -d --build --remove-orphans",
|
|
"dev:docker:build": "docker compose -p triggerdotdev-dev-docker -f docker/dev-compose.yml up -d --build",
|
|
"dev:docker:stop": "docker compose -p triggerdotdev-dev-docker -f docker/dev-compose.yml stop",
|
|
"test": "turbo run test --concurrency=1 -- --run",
|
|
"test:webapp": "turbo run test --filter webapp -- --run",
|
|
"test:packages": "turbo run test --concurrency=1 --filter \"@trigger.dev/*\" -- --run",
|
|
"test:internal": "turbo run test --concurrency=1 --filter \"@internal/*\" -- --run",
|
|
"test:dev": "turbo run test:dev",
|
|
"start": "turbo run start",
|
|
"check-exports": "turbo run check-exports",
|
|
"clean": "turbo run clean",
|
|
"clean:node_modules": "find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +",
|
|
"typecheck": "turbo run typecheck",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:ui": "playwright test --ui",
|
|
"test:e2e:dev": "turbo run test:e2e:dev",
|
|
"test:e2e:ci": "turbo run test:e2e:ci",
|
|
"setup": "turbo run generate db:migrate:force db:seed",
|
|
"env:pull": "turbo run env:pull",
|
|
"changeset:add": "changeset",
|
|
"changeset:version": "changeset version",
|
|
"changeset:release": "pnpm run build --filter \"@trigger.dev/*\" --filter \"trigger.dev\" && changeset publish",
|
|
"changeset:v4": "changeset pre enter v4",
|
|
"changeset:normal": "changeset pre exit",
|
|
"clean:sourcemaps": "turbo run clean:sourcemaps",
|
|
"storybook": "turbo run storybook"
|
|
},
|
|
"devDependencies": {
|
|
"@manypkg/cli": "^0.19.2",
|
|
"@playwright/test": "^1.36.2",
|
|
"@trigger.dev/database": "workspace:*",
|
|
"@types/node": "20.14.14",
|
|
"@vitest/coverage-v8": "3.1.4",
|
|
"autoprefixer": "^10.4.12",
|
|
"eslint-plugin-turbo": "^2.0.4",
|
|
"lefthook": "^1.11.3",
|
|
"pkg-types": "1.1.3",
|
|
"prettier": "^3.0.0",
|
|
"tsx": "^3.7.1",
|
|
"turbo": "^1.10.3",
|
|
"typescript": "5.5.4",
|
|
"vite": "^5.4.21",
|
|
"vite-tsconfig-paths": "^4.0.5",
|
|
"vitest": "3.1.4"
|
|
},
|
|
"packageManager": "pnpm@10.23.0",
|
|
"dependencies": {
|
|
"@changesets/cli": "2.26.2",
|
|
"@remix-run/changelog-github": "^0.0.5",
|
|
"agentcrumbs": "^0.5.0",
|
|
"node-fetch": "2.6.x"
|
|
},
|
|
"pnpm": {
|
|
"patchedDependencies": {
|
|
"@changesets/assemble-release-plan@5.2.4": "patches/@changesets__assemble-release-plan@5.2.4.patch",
|
|
"engine.io-parser@5.2.2": "patches/engine.io-parser@5.2.2.patch",
|
|
"graphile-worker@0.16.6": "patches/graphile-worker@0.16.6.patch",
|
|
"redlock@5.0.0-beta.2": "patches/redlock@5.0.0-beta.2.patch",
|
|
"@kubernetes/client-node@1.0.0": "patches/@kubernetes__client-node@1.0.0.patch",
|
|
"@sentry/remix@9.46.0": "patches/@sentry__remix@9.46.0.patch",
|
|
"@upstash/ratelimit@1.1.3": "patches/@upstash__ratelimit.patch",
|
|
"antlr4ts@0.5.0-alpha.4": "patches/antlr4ts@0.5.0-alpha.4.patch",
|
|
"@window-splitter/state@0.4.1": "patches/@window-splitter__state@0.4.1.patch"
|
|
},
|
|
"overrides": {
|
|
"typescript": "5.5.4",
|
|
"@types/node": "20.14.14",
|
|
"express@^4>body-parser": "1.20.3",
|
|
"@remix-run/dev@2.17.4>tar-fs": "2.1.4",
|
|
"testcontainers@10.28.0>tar-fs": "3.1.1",
|
|
"form-data@^2": "2.5.4",
|
|
"form-data@^3": "3.0.4",
|
|
"form-data@^4": "4.0.4",
|
|
"axios@1.9.0": ">=1.12.0",
|
|
"js-yaml@>=3.0.0 <3.14.2": "3.14.2",
|
|
"js-yaml@>=4.0.0 <4.1.1": "4.1.1",
|
|
"jws@<3.2.3": "3.2.3",
|
|
"qs@>=6.0.0 <6.14.1": "6.14.1",
|
|
"systeminformation@>=5.0.0 <5.27.14": "5.27.14",
|
|
"lodash@>=4.0.0 <4.17.23": "4.17.23"
|
|
},
|
|
"onlyBuiltDependencies": [
|
|
"@depot/cli",
|
|
"@fingerprintjs/fingerprintjs-pro-react",
|
|
"@prisma/client",
|
|
"@prisma/engines",
|
|
"@sentry/cli",
|
|
"@swc/core",
|
|
"better-sqlite3",
|
|
"cpu-features",
|
|
"esbuild",
|
|
"lefthook",
|
|
"prisma",
|
|
"protobufjs",
|
|
"sharp",
|
|
"ssh2",
|
|
"turbo"
|
|
]
|
|
}
|
|
}
|