fix(security): upgrade Remix packages 2.1.0 → 2.17.4

[devin-ai-integration]

Summary

Upgrades all @remix-run/* packages in apps/webapp from 2.1.0 → 2.17.4 to address security vulnerabilities. This is a recreation of #2951 on a fresh checkout of main.

Updated packages:

• @remix-run/express, @remix-run/node, @remix-run/react, @remix-run/serve, @remix-run/server-runtime: 2.1.0 → 2.17.4
• @remix-run/router: ^1.15.3 → ^1.23.2
• @remix-run/dev, @remix-run/eslint-config, @remix-run/testing: 2.1.0 → 2.17.4

Also updated in root package.json overrides:

• @remix-run/dev@2.17.4>tar-fs: 2.1.3 → 2.1.4
• testcontainers@10.28.0>tar-fs: 3.0.9 → 3.1.1

No application code changes — only package.json files and the regenerated pnpm-lock.yaml.

Review & Testing Checklist for Human

• Verify webapp builds successfully — run pnpm turbo build --filter webapp and confirm no build errors from the Remix upgrade
• Check auth flows work at runtime — remix-auth-email-link and remix-auth-github declare peer deps on @remix-run/server-runtime@^1.x, which is now 2.17.4. Confirm login/auth still works end-to-end
• Spot-check Remix 2.1→2.17 changelog for breaking changes — this is a large minor version jump; review Remix releases for anything that could affect routing, data loading, or server runtime behavior
• Verify tar-fs override versions — confirm tar-fs@2.1.4 and tar-fs@3.1.1 resolve the targeted security advisories

Recommended test plan: deploy to a staging environment and exercise the core webapp flows (login, dashboard navigation, task creation/viewing) to catch any runtime regressions from the Remix upgrade.

Notes

• Peer dependency warnings for remix-auth-email-link and remix-auth-github (expecting @remix-run/server-runtime@^1.x) were present in the original PR as well and appear to be pre-existing
• The lockfile diff is large but mechanical — driven entirely by the Remix version bump cascading through transitive dependencies

Link to Devin session: https://app.devin.ai/sessions/d9fa9953b9bf40e5a8d12b8f5ba5b86b
Requested by: @ericallam

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1d0a263

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Thanks for your contribution! We require all external PRs to be opened in draft status first so you can address CodeRabbit review comments and ensure CI passes before requesting a review. Please re-open this PR as a draft. See CONTRIBUTING.md for details.

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🚩 Documentation references to 'Remix 2.1.0' are now stale

Multiple guidance files reference 'Remix 2.1.0' which is now incorrect after this PR:

• CLAUDE.md:100 states apps/webapp: Remix 2.1.0 app
• apps/webapp/CLAUDE.md:1 states Remix 2.1.0 app serving as the main API...
• .cursor/rules/webapp.mdc states is a Remix 2.1.0 app that uses an express server

These are AI agent guidance files. After this PR merges, agents will be given outdated version information, which could lead them to reference wrong API behaviors or compatibility constraints. Consider updating these references to 2.17.4.

---

Was this helpful? React with 👍 or 👎 to provide feedback.