Build Better Websites. Create modern, resilient user experiences with web fundamentals.
by remix-runLast 12 weeks ยท 345 commits
3 of 6 standards met
Repository: remix-run/remix. Description: Build Better Websites. Create modern, resilient user experiences with web fundamentals. Stars: 32474, Forks: 2726. Primary language: TypeScript. Languages: TypeScript (99.1%), JavaScript (0.6%), HTML (0.2%), CSS (0.1%), Shell (0%). License: MIT. Homepage: https://remix.run Latest release: static-middleware@0.4.4 (1w ago). Open PRs: 24, open issues: 35. Last activity: 1d ago. Community health: 50%. Top contributors: mjackson, brophdawg11, remix-run-bot, chaance, ryanflorence, pcattori, MichaelDeBoey, mcansh, markdalgleish, github-actions[bot] and others.
TypeScript
Summary Add preferred MIME type overrides in the codegen for extensions where the algorithm picks an uncommon type: : โ per RFC 4337 ยง2 which specifies as the general-purpose type : โ which is the historically used type by Microsoft and browsers Changes : Add map applied after the main algorithm : Updated generated output : Updated test expectation Fixes #11106 Fixes #11107
Security hardening for SQL layer and migration infrastructure This PR fixes several injection and correctness vulnerabilities across the data-table SQL utilities and migration system: SqlStatement branding โ adds an unforgeable Symbol brand so isSqlStatement() rejects plain user-controlled objects, preventing raw SQL injection via sql\`` template literals. MySQL backslash escaping โ adds a backslashEscapes option to quoteLiteral to handle MySQL's non-standard backslash escaping (CVE pattern: Sequelize CVE-2019-10748). Migration drift detection โ replaces the id:name checksum fallback with a SHA-256 content hash of the migration's up/down implementations, making drift detectable after accidental edits. Table name injection in journal store โ replaces raw string concatenation of tableName with ANSI double-quote identifier quoting, and swaps an error-swallowing raw SQL probe for adapter.hasTable(). Multi-segment table name rejection โ toTableRef() now throws early for names with more than one dot, preventing malformed identifier segments from reaching downstream adapters.
Moved benchmark execution out of and into to more directly interop with . See for details