@remix-run Server-runtime vulnerabilities

• @remix-run server-runtime, @tanstack react-router +1 more React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass CVE-2026-53663 Fix available 3.1 LowJune 15, 2026