Sourcemap Explorer
Stack · npm package

@remix-run/react

React DOM bindings for Remix

latest 2.17.5· MIT· 1,102 versions publishedView on npm

About

React DOM bindings for Remix

What detecting @remix-run/react tells you about a site

@remix-run/react means the site is (or was) a Remix application — a full-stack React framework built on web standards, with nested routes, loaders and actions that run on the server. Its presence signals a team that prioritised progressive enhancement and server-driven data over a client-heavy SPA.

Why the exact @remix-run/react version matters

Remix converged into React Router v7, so the exact version tells you whether the app is on classic Remix or has moved to the unified React Router framework — a meaningful signal of how current the stack is.

@remix-run/react in a real-world stack

When you find @remix-run/react in a bundle, it rarely travels alone. react, react-dom, and @remix-run/node or another server runtime adapter.

Quick facts

Latest version2.17.5
LicenseMIT
Installnpm install @remix-run/react
Direct dependencies5
Peer dependenciesreact, react-dom, typescript

This package powers Remix

The @remix-run/react package is the canonical implementation of Remix. Sourcemap Explorer uses this exact npm package as the framework-level fingerprint when it flags Remix on a page — both via the bundled node_modules/@remix-run/react/ source paths and via the embedded package.json inside the JavaScript sourcemap.

Common pairings

Packages this one expects to find in the same project. Each is also a Sourcemap Explorer detection target.

reactreact-domtypescript

What @remix-run/react pulls in

@remix-run/react declares 5 direct dependencies — each one also rides into any bundle that ships @remix-run/react, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .

react-routerturbo-streamreact-router-dom@remix-run/router@remix-run/server-runtime

How Sourcemap Explorer detects @remix-run/react

@remix-run/react ships as v2.17.5, published 2026-06-01 and carries 5 direct dependencies, 3 peer dependencies (react, react-dom, typescript), 1,102 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when @remix-run/react rides inside a deployed bundle — here is how the detection works.

We catch @remix-run/react from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/@remix-run/react/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

  1. 1

    Confirm the site exposes sourcemaps

    In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `@remix-run/react` paths live.

  2. 2

    Find the package in the bundle

    Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/@remix-run/react/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/@remix-run/react/package.json` gives you the exact installed version.

  3. 3

    Read the version directly from package.json

    Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/@remix-run/react/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of @remix-run/react

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the @remix-run/react version a site actually ships against the ecosystem.

Major
First release
Date
v2
2.0.0
2023-09-15
v1
1.0.3
2021-11-22
v0
0.21.0
2021-11-17

Recent security advisories for @remix-run/react

The 2 most recent advisories affecting some versions of @remix-run/react, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

  1. HIGHCVE-2026-21884· 2026-01-08

    React Router SSR XSS in ScrollRestoration

  2. HIGHCVE-2025-59057· 2026-01-08

    React Router has XSS Vulnerability

Recent versions

Version
Released
2.17.5
2026-06-01
2.17.4
2026-01-12
2.17.3
2026-01-07
2.17.2
2025-10-29
2.17.1
2025-09-17
2.17.0
2025-07-25
2.16.8
2025-05-29
2.16.7
2025-05-19

@remix-run/react README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.



Remix



Welcome to Remix 3!

This is the source repository for Remix 3. It is under active development.

We published a blog post earlier this year with some of our thoughts around Remix 3. It explains our philosophy for web development and why we think the time is right for something new. When working on Remix 3, we follow these principles:

  1. Model-First Development. AI fundamentally shifts the human-computer interaction model for both user experience and developer workflows. Optimize the source code, documentation, tooling, and abstractions for LLMs. Additionally, develop abstractions for applications to use models in the product itself, not just as a tool to develop it.
  2. Build on Web APIs. Sharing abstractions across the stack greatly reduces the amount of context switching, both for humans and machines. Build on the foundation of Web APIs and JavaScript because it is the only full stack ecosystem.
  3. Religiously Runtime. Designing for bundlers/compilers/typegen (and any pre-runtime static analysis) leads to poor API design that eventually pollutes the entire system. All packages must be designed with no expectation of static analysis and all tests must run without bundling. Because browsers are involved, --import loaders for simple transformations like TypeScript and JSX are permissible.
  4. Avoid Dependencies. Dependencies lock you into somebody else's roadmap. Choose them wisely, wrap them completely, and expect to replace most of them with our own package eventually. The goal is zero.
  5. Demand Composition. Abstractions should be single-purpose and replaceable. A composable abstraction is easy to add and remove from an existing program. Every package must be useful and documented independent of any other context. New features should first be attempted as a new package. If impossible, attempt to break up the existing package to make it more composable. However, tightly coupled modules that almost always change together in both directions should be moved to the same package.
  6. Distribute Cohesively. Extremely composable ecosystems are difficult to learn and use. Remix will be distributed as a single remix package for both distribution and documentation.

Goals

Although we recommend the remix package for ease of use, all packages that make up Remix should be usable standalone as well. This forces us to consider package boundaries and helps us define public interfaces that are portable and interoperable.

Each package in Remix:

  • Has a single responsibility
  • Prioritizes web standards to ensure maximum interoperability and portability across JavaScript runtimes
  • Augments standards unobtrusively where they are missing or incomplete, minimizing incompatibility risks

This means Remix code is portable by default. Remix packages work seamlessly across Node.js, Bun, Deno, Cloudflare Workers, and other environments.

We leverage server-side web APIs when they are available:

The benefit is code that's not just reusable, but future-proof.

Packages

Most packages in this repository are standalone JavaScript/TypeScript tools. The remix package composes them under one umbrella for distribution and documentation.

  • assert: Node assert-compatible utilities for any JavaScript environment
  • assets: Fetch-based server for compiling browser JS/TS and CSS assets on demand
  • async-context-middleware: Middleware for storing request context in AsyncLocalStorage
  • auth: Browser login, OAuth, and OIDC helpers for Remix
  • auth-middleware: Pluggable authentication middleware for Remix
  • cli: Command-line interface for Remix
  • compression-middleware: Middleware for compressing HTTP responses
  • cookie: A toolkit for working with cookies in JavaScript
  • cop-middleware: Middleware for tokenless cross-origin protection in Fetch API servers
  • cors-middleware: Middleware for handling CORS in Fetch API servers
  • csrf-middleware: Middleware for CSRF protection in Fetch API servers
  • data-schema: Tiny, standards-aligned schema validation
  • data-table: A typed, relational query toolkit for JavaScript
  • data-table-mysql: MySQL adapter for remix/data-table
  • data-table-postgres: PostgreSQL adapter for remix/data-table
  • data-table-sqlite: SQLite adapter for remix/data-table
  • fetch-proxy: An HTTP proxy for the web Fetch API
  • fetch-router: A minimal, composable router for the web Fetch API
  • file-storage: Key/value storage for JavaScript File objects
  • file-storage-s3: S3 backend for remix/file-storage
  • form-data-middleware: Middleware for parsing FormData from request bodies
  • form-data-parser: A request.formData() wrapper with streaming file upload handling
  • fs: Filesystem utilities using the Web File API
  • headers: A toolkit for working with HTTP headers in JavaScript
  • html-template: HTML template tag with auto-escaping for JavaScript
  • lazy-file: Lazy, streaming files for JavaScript
  • logger-middleware: Middleware for logging HTTP requests and responses
  • method-override-middleware: Middleware for overriding HTTP request methods from form data
  • mime: Utilities for working with MIME types
  • multipart-parser: A fast, efficient parser for multipart streams in any JavaScript environment
  • node-fetch-server: Build servers for Node.js using the web fetch API
  • node-tsx: Run Node.js with TypeScript and JSX syntax support
  • remix: The Remix web framework
  • response: Response helpers for the web Fetch API
  • route-pattern: Match and generate URLs with strong typing
  • session: Session management for JavaScript
  • session-middleware: Middleware for managing sessions with cookie-based storage
  • session-storage-memcache: Memcache session storage for remix/session
  • session-storage-redis: Redis session storage for remix/session
  • static-middleware: Middleware for serving static files from the filesystem
  • tar-parser: A fast, efficient parser for tar streams in any JavaScript environment
  • terminal: Terminal output utilities for JavaScript libraries and CLIs
  • test: A test framework for JavaScript and TypeScript projects
  • ui: View layer with reconciler, component model, and first-party UI components

Installation

To try the current Remix beta, install the next dist-tag:

npm install remix@next

To create a new Remix app with the CLI, use npx remix@next new:

npx remix@next new my-remix-app

If you want to play around with the bleeding edge, we also build the latest main branch into a preview/main branch which can be installed directly with pnpm (version 9+):

pnpm install "remix-run/remix#preview/main&path:packages/remix"

Or, just install a single package:

pnpm install "remix-run/remix#preview/main&path:packages/fetch-router"

Agent Skills For Building Apps

Agents that are starting a Remix 3 app from this repository should use the remix app skill. The CLI prepack step copies this skill into the app template so generated apps can use the same guidance.

Contributing

We welcome contributions! If you'd like to contribute, please feel free to open an issue or submit a pull request. See CONTRIBUTING for more information.

License

See LICENSE

FAQ

What is @remix-run/react used for?

React DOM bindings for Remix

How can I tell if a website is using @remix-run/react?

Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `@remix-run/react` from two complementary signals: `node_modules/@remix-run/react/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.

How do I find out which version of @remix-run/react a website is running?

Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `@remix-run/react/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/@remix-run/react/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 2.17.5, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.

What is the latest version of @remix-run/react?

2.17.5, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.

Is @remix-run/react actively maintained?

Very actively maintained — the last release shipped within the past three months. The last published release was 2026-06-01. Source code: https://github.com/remix-run/remix.

What is the relationship between @remix-run/react and Remix?

@remix-run/react is the canonical npm package for Remix. Sourcemap Explorer treats finding `@remix-run/react` in a bundle as the framework-level signal that Remix is on the page, and the page you're reading is the canonical Sourcemap Explorer entry for the package itself.

Does @remix-run/react have known security vulnerabilities?

2 recent advisories affecting some versions of @remix-run/react are listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.

Where can I read more?

Project homepage: https://github.com/remix-run/remix#readme. Source code: https://github.com/remix-run/remix. Published on npm: https://www.npmjs.com/package/@remix-run/react. Licensed as MIT.

Detected by Sourcemap Explorer

When a bundle ships sourcemaps, we read the embedded package.json for @remix-run/react and report the precise version (the registry's latest is v2.17.5, published 2026-06-01; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.

Install free on Chrome