Vulnerability in transient dependency (CVE-2025-32014)

[Evanion]

Reproduction

n/a

System Info

n/a

Used Package Manager

npm

Expected Behavior

n/a

Actual Behavior

@remix-run/dev depends on an old (3.5 y) version of remark-mdx-frontmatter (^1.0.1)
that in turn relies on a vulnerable version of estree-util-value-to-estree.

Current version of remark-mdx-frontmatter is 5.1.0, that relies on estree-util-value-to-estree@3.0.0.
to really fix the vulnerability you need to upgrade to 3.3.3, but since it's not a major version bump, it should be possible to override, once the mdx package is up to date