# What changed in @remix-run/dev

> 5 changes in @remix-run/dev 2 from its official release notes, upgrade guides and advisories: 5 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@remix-run/dev/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @remix-run/dev 2

### Security

- React Router: Potential CSRF via PUT/PATCH/DELETE document requests (2.17.5) — [security advisory](https://github.com/advisories/GHSA-84G9-W2XQ-VCV6)
- React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint (2.17.5) — [security advisory](https://github.com/advisories/GHSA-8X6R-G9MW-2R78)
- React Router has CSRF issue in Action/Server Action Request Processing (2.17.3) — [security advisory](https://github.com/advisories/GHSA-H5CW-625J-3RXH)
- React Router SSR XSS in ScrollRestoration (2.17.3) — [security advisory](https://github.com/advisories/GHSA-8V8X-CX79-35W7)
- React Router has Path Traversal in File Session Storage (2.17.2) — [security advisory](https://github.com/advisories/GHSA-9583-H5HC-X8CW)