Skip to content

feat: add Next.js and Vinext compatibility with strict release gates - #52

Merged
tannerlinsley merged 11 commits into
mainfrom
taren/stable-framework-support
Oct 25, 2026
Merged

tannerlinsley merged 11 commits into
mainfrom
taren/stable-framework-support

Conversation

@tannerlinsley

@tannerlinsley tannerlinsley commented Oct 25, 2026 •

Copy link
Copy Markdown
Member

Adds browser integrations for Next.js 15.5 and 16.0 through 16.4, plus Vinext 1.3.0, covering App Router and Pages Router. Existing React imports stay unchanged and native React remains on the server. Redact retains its synchronous rendering model.

Ships maintained corrections for Next 16.2 development cache detection, Vinext module identity and Pages data navigation, development Flight timing, and Cloudflare's development evaluator. The optional Cloudflare entry includes the pinned distribution, original license, and reproducible provenance. Standard dependency overrides select the published Undici and fflate security fixes. Installed framework files stay intact.

Validation on the frozen package:

  • 1,859 tests passed, with 91 existing skips; types, package imports, declarations, and all 38 size gates passed.
  • Next.js: all 162 configurations and 2,694 scenarios passed in the complete CI matrix.
  • Vinext: all 102 local configurations and 1,410 scenarios passed from a fresh npm consumer, plus all 18 hosted configurations and 282 scenarios.
  • Final consumer audit: zero vulnerabilities. Negative controls reproduce the original dependency failures.
  • Full client: 27,921 / 28,183 gzip bytes. Default Vite client: 23,304 / 23,335. Original limits are unchanged.

The refreshed upstream Vinext benchmark ran all seven scenarios, six rounds per implementation, and six browser workload checks. Client output remains 39.4 KB gzip smaller (25.4%). Production build times are effectively equal; local startup was 2.2% faster for App Router and 4.9% faster for the large Pages fixture. Browser rendering speed was not measured. Reports retain the earlier failures and raw measurements.

Docs and Changesets are prepared. Publication still uses the normal required CI and Changesets workflow.

@changeset-bot

changeset-bot Bot commented Oct 25, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 1666d37

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@tanstack/redact Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 25, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Too many files!

This PR contains 333 files, which is 233 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

Usage-priced reviews support at most 300 files.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 54f4aa39-2999-4f9f-a54c-50b3df4454ca
Commits

Reviewing files that changed from the base of the PR and between f974379 and 1666d37.

Files ignored due to path filters: 14
  • examples/next-demo/public/pixel.png is excluded by !**/*.png
  • examples/next-journey/app/icon.svg is excluded by !**/*.svg
  • packages/redact/vendor/cloudflare-vite-plugin/dist/chunk-U6NEESU5-BmLHqeIt.mjs is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/index.d.mts is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/index.mjs is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/open-PCXX3ZDZ-DYH87NhH.mjs is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/package-4cnqy5mM.mjs is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/workers/asset-worker/index.js is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/workers/router-worker/index.js is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/workers/runner-worker/index.js is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/workers/runner-worker/module-runner-legacy.js is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/workers/runner-worker/module-runner.js is excluded by !**/dist/**
  • packages/redact/vendor/cloudflare-vite-plugin/dist/workers/vite-proxy-worker/index.js is excluded by !**/dist/**
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
Files selected for processing: 333
  • .changeset/act-event-compatibility.md
  • .changeset/next-integration.md
  • .changeset/vinext-integration.md
  • .github/workflows/next.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • .github/workflows/vinext.yml
  • .gitignore
  • .nvmrc
  • README.md
  • benchmarks/NEXT_COVERAGE.md
  • benchmarks/VINEXT_BENCHMARKS.md
  • benchmarks/VINEXT_COVERAGE.md
  • benchmarks/results/cloudflare-dev-eval-diagnostic.json
  • benchmarks/results/cloudflare-dev-eval-playground.json
  • benchmarks/results/cloudflare-undici-regression.json
  • benchmarks/results/framework-hosted-cache-diagnostic.json
  • benchmarks/results/framework-owned-security.json
  • benchmarks/results/framework-release-next.json
  • benchmarks/results/framework-release-sizes.json
  • benchmarks/results/framework-release-validation.json
  • benchmarks/results/framework-release-vinext-combined.json
  • benchmarks/results/framework-release-vinext-hosted-initial.json
  • benchmarks/results/framework-release-vinext-hosted.json
  • benchmarks/results/framework-release-vinext-pages.json
  • benchmarks/results/framework-release-vinext.json
  • benchmarks/results/framework-reload-diagnostic.json
  • benchmarks/results/framework-stable-next.json
  • benchmarks/results/framework-stable-validation.json
  • benchmarks/results/framework-stable-vinext-combined.json
  • benchmarks/results/framework-stable-vinext-hosted.json
  • benchmarks/results/framework-stable-vinext-pages.json
  • benchmarks/results/framework-stable-vinext.json
  • benchmarks/results/framework-upstream-fix-diagnostics.json
  • benchmarks/results/framework-upstream-prs.json
  • benchmarks/results/next-16.2-backport-integration.json
  • benchmarks/results/next-16.2-backport-upstream.json
  • benchmarks/results/vinext-final-2026-10-25.json
  • benchmarks/results/vinext-official-2026-10-25.json
  • benchmarks/upstream/README.md
  • benchmarks/upstream/cloudflare-dev-eval-pr.md
  • benchmarks/upstream/cloudflare-dev-eval.mjs
  • benchmarks/upstream/cloudflare-dev-eval.patch
  • benchmarks/upstream/cloudflare-undici-pr.md
  • benchmarks/upstream/cloudflare-undici.patch
  • benchmarks/upstream/next-16.2-development-cache.patch
  • benchmarks/upstream/vinext-pages-data-pr.md
  • benchmarks/upstream/vinext-pages-data.mjs
  • benchmarks/upstream/vinext-pages-data.patch
  • docs/compatibility.md
  • docs/config.json
  • docs/installation.md
  • docs/next.md
  • docs/overview.md
  • docs/performance.md
  • docs/quick-start.md
  • docs/verification.md
  • docs/vinext.md
  • examples/next-demo/.gitignore
  • examples/next-demo/app/actions/direct/page.jsx
  • examples/next-demo/app/actions/page.jsx
  • examples/next-demo/app/actions/save.js
  • examples/next-demo/app/api/release-slow/route.js
  • examples/next-demo/app/api/runtime/route.js
  • examples/next-demo/app/cached/page.jsx
  • examples/next-demo/app/components/lazy-counter.jsx
  • examples/next-demo/app/components/page.jsx
  • examples/next-demo/app/components/page.module.css
  • examples/next-demo/app/counter.jsx
  • examples/next-demo/app/fail/action.js
  • examples/next-demo/app/fail/error.jsx
  • examples/next-demo/app/fail/page.jsx
  • examples/next-demo/app/gallery/@modal/(.)photo/[id]/page.jsx
  • examples/next-demo/app/gallery/@modal/default.jsx
  • examples/next-demo/app/gallery/@modal/page.jsx
  • examples/next-demo/app/gallery/layout.jsx
  • examples/next-demo/app/gallery/page.jsx
  • examples/next-demo/app/gallery/photo-dialog.jsx
  • examples/next-demo/app/gallery/photo/[id]/page.jsx
  • examples/next-demo/app/ids/page.jsx
  • examples/next-demo/app/increment.js
  • examples/next-demo/app/layout.jsx
  • examples/next-demo/app/mutations/actions.js
  • examples/next-demo/app/mutations/forms.jsx
  • examples/next-demo/app/mutations/page.jsx
  • examples/next-demo/app/mutations/store.js
  • examples/next-demo/app/other/page.jsx
  • examples/next-demo/app/page.jsx
  • examples/next-demo/app/routing/[slug]/page.jsx
  • examples/next-demo/app/routing/controls.jsx
  • examples/next-demo/app/routing/layout.jsx
  • examples/next-demo/app/routing/not-found.jsx
  • examples/next-demo/app/routing/pending/loading.jsx
  • examples/next-demo/app/routing/pending/page.jsx
  • examples/next-demo/app/routing/shell.jsx
  • examples/next-demo/app/slow/gate.js
  • examples/next-demo/app/slow/loading.jsx
  • examples/next-demo/app/slow/page.jsx
  • examples/next-demo/app/stream/page.jsx
  • examples/next-demo/jsconfig.json
  • examples/next-demo/next.config.mjs
  • examples/next-demo/package.json
  • examples/next-demo/pages/legacy-data/[slug].jsx
  • examples/next-demo/pages/legacy-other.jsx
  • examples/next-demo/pages/legacy-static.jsx
  • examples/next-demo/pages/legacy.jsx
  • examples/next-journey/.gitignore
  • examples/next-journey/README.md
  • examples/next-journey/app/actions.js
  • examples/next-journey/app/api/reset/route.js
  • examples/next-journey/app/data.js
  • examples/next-journey/app/globals.css
  • examples/next-journey/app/icons.jsx
  • examples/next-journey/app/layout.jsx
  • examples/next-journey/app/not-found.jsx
  • examples/next-journey/app/page.jsx
  • examples/next-journey/app/store.js
  • examples/next-journey/app/task-list.jsx
  • examples/next-journey/app/tasks/[id]/loading.jsx
  • examples/next-journey/app/tasks/[id]/page.jsx
  • examples/next-journey/app/tasks/[id]/task-controls.jsx
  • examples/next-journey/comparison/bridge.jsx
  • examples/next-journey/comparison/comparison.css
  • examples/next-journey/comparison/comparison.js
  • examples/next-journey/comparison/index.html
  • examples/next-journey/next.config.mjs
  • examples/next-journey/package.json
  • examples/next-static/.gitignore
  • examples/next-static/app/counter.jsx
  • examples/next-static/app/layout.jsx
  • examples/next-static/app/not-found.jsx
  • examples/next-static/app/page.jsx
  • examples/next-static/app/posts/[slug]/page.jsx
  • examples/next-static/app/style.css
  • examples/next-static/next.config.mjs
  • examples/next-static/package.json
  • examples/vinext-demo/.gitignore
  • examples/vinext-demo/README.md
  • examples/vinext-demo/fixtures/app/concurrent/page.jsx
  • examples/vinext-demo/fixtures/app/select-reset/action.js
  • examples/vinext-demo/fixtures/app/select-reset/page.jsx
  • examples/vinext-demo/next.config.mjs
  • examples/vinext-demo/package.json
  • examples/vinext-demo/vite.config.mjs
  • examples/vinext-demo/wrangler.jsonc
  • package.json
  • packages/redact/package.json
  • packages/redact/src/cloudflare/index.ts
  • packages/redact/src/core/attributes.ts
  • packages/redact/src/core/browser.ts
  • packages/redact/src/core/functions.ts
  • packages/redact/src/core/internal.ts
  • packages/redact/src/core/resource-hints.ts
  • packages/redact/src/core/types.ts
  • packages/redact/src/dom/_all.ts
  • packages/redact/src/dom/client.ts
  • packages/redact/src/dom/commit.ts
  • packages/redact/src/dom/devtools-effects.ts
  • packages/redact/src/dom/devtools.ts
  • packages/redact/src/dom/dispatcher.ts
  • packages/redact/src/dom/document-metadata.ts
  • packages/redact/src/dom/dom.ts
  • packages/redact/src/dom/error-info.ts
  • packages/redact/src/dom/features/activity/full.ts
  • packages/redact/src/dom/features/activity/stub.ts
  • packages/redact/src/dom/features/class/full.ts
  • packages/redact/src/dom/features/class/stub.ts
  • packages/redact/src/dom/features/context/full.ts
  • packages/redact/src/dom/features/context/stub.ts
  • packages/redact/src/dom/features/forward-ref/full.ts
  • packages/redact/src/dom/features/forward-ref/stub.ts
  • packages/redact/src/dom/features/fragment-refs/index.ts
  • packages/redact/src/dom/features/fragment-refs/stub.ts
  • packages/redact/src/dom/features/hydration/full.ts
  • packages/redact/src/dom/features/hydration/stub.ts
  • packages/redact/src/dom/features/index.ts
  • packages/redact/src/dom/features/lazy/full.ts
  • packages/redact/src/dom/features/lazy/stub.ts
  • packages/redact/src/dom/features/memo/full.ts
  • packages/redact/src/dom/features/memo/stub.ts
  • packages/redact/src/dom/features/portal/full.ts
  • packages/redact/src/dom/features/suspense-runtime/index.ts
  • packages/redact/src/dom/features/suspense-runtime/stub.ts
  • packages/redact/src/dom/features/suspense/full.ts
  • packages/redact/src/dom/features/suspense/stub.ts
  • packages/redact/src/dom/features/view-transition/full.ts
  • packages/redact/src/dom/features/view-transition/resources.ts
  • packages/redact/src/dom/features/view-transition/stub.ts
  • packages/redact/src/dom/features/view-transition/visual.ts
  • packages/redact/src/dom/form-actions.ts
  • packages/redact/src/dom/form-controls.ts
  • packages/redact/src/dom/fragment-instance.ts
  • packages/redact/src/dom/index.ts
  • packages/redact/src/dom/react-ids.ts
  • packages/redact/src/dom/reconcile.ts
  • packages/redact/src/dom/refresh.ts
  • packages/redact/src/dom/resource-hints.ts
  • packages/redact/src/dom/resource-store.ts
  • packages/redact/src/dom/resources.ts
  • packages/redact/src/dom/retained-effects.ts
  • packages/redact/src/dom/root-internal.ts
  • packages/redact/src/dom/root.ts
  • packages/redact/src/dom/test-utils.ts
  • packages/redact/src/dom/transitions.ts
  • packages/redact/src/dom/tree.ts
  • packages/redact/src/dom/walk.ts
  • packages/redact/src/next/client.ts
  • packages/redact/src/next/dev-cache-loader.cjs
  • packages/redact/src/next/index.ts
  • packages/redact/src/next/loader.cjs
  • packages/redact/src/next/react.ts
  • packages/redact/src/react/act.ts
  • packages/redact/src/react/action-scope.ts
  • packages/redact/src/react/children.ts
  • packages/redact/src/react/class.ts
  • packages/redact/src/react/form-state.ts
  • packages/redact/src/react/hooks.ts
  • packages/redact/src/react/index.ts
  • packages/redact/src/react/jsx-runtime.ts
  • packages/redact/src/react/memo.ts
  • packages/redact/src/react/shared-internals.ts
  • packages/redact/src/react/thenable.ts
  • packages/redact/src/server/dispatcher.ts
  • packages/redact/src/server/escape.ts
  • packages/redact/src/server/resource-hints.ts
  • packages/redact/src/server/stream.ts
  • packages/redact/src/server/walk.ts
  • packages/redact/src/vinext/compatibility.ts
  • packages/redact/src/vinext/flight-timing.ts
  • packages/redact/src/vinext/index.ts
  • packages/redact/src/vite/index.ts
  • packages/redact/vendor/cloudflare-vite-plugin/LICENSE
  • packages/redact/vendor/cloudflare-vite-plugin/README.md
  • packages/redact/vendor/cloudflare-vite-plugin/package.json
  • packages/redact/vendor/cloudflare-vite-plugin/provenance.json
  • scripts/actions-browser.config.mjs
  • scripts/browser-api-browser.config.mjs
  • scripts/browser-reload.mjs
  • scripts/build.mjs
  • scripts/diagnose-vinext-loading.mjs
  • scripts/diagnose-vinext-workers.mjs
  • scripts/measure-next-journey.mjs
  • scripts/measure-size.mjs
  • scripts/next-browser-checks.mjs
  • scripts/next-browser-errors.mjs
  • scripts/next-extended-checks.mjs
  • scripts/next-journey.mjs
  • scripts/next-results.mjs
  • scripts/next-versions.mjs
  • scripts/prepare-next-fixture.mjs
  • scripts/prepare-vinext-consumer.mjs
  • scripts/prepare-vinext-fixture.mjs
  • scripts/report-next-coverage.mjs
  • scripts/report-vinext-coverage.mjs
  • scripts/report-vinext-pages-coverage.mjs
  • scripts/size-check.mjs
  • scripts/test-browser-lifecycle.mjs
  • scripts/test-browser-reload.mjs
  • scripts/test-cloudflare.mjs
  • scripts/test-framework-dependencies.mjs
  • scripts/test-next-controls.mjs
  • scripts/test-next-coverage.mjs
  • scripts/test-next-deployments.mjs
  • scripts/test-next-journey.mjs
  • scripts/test-next-matrix.mjs
  • scripts/test-next-static.mjs
  • scripts/test-next.mjs
  • scripts/test-vinext-consumer.mjs
  • scripts/test-vinext-coverage.mjs
  • scripts/test-vinext-hosted-state.mjs
  • scripts/test-vinext-hosted.mjs
  • scripts/test-vinext-pages.mjs
  • scripts/test-vinext-static.mjs
  • scripts/test-vinext.mjs
  • scripts/vendor-cloudflare.mjs
  • scripts/verify-build.mjs
  • scripts/vinext-browser-errors.mjs
  • scripts/vinext-edge-checks.mjs
  • scripts/vinext-hosted-cache.mjs
  • scripts/vinext-hosted-state.mjs
  • scripts/vinext-matrix.mjs
  • scripts/vinext-results.mjs
  • scripts/vinext-static-checks.mjs
  • scripts/vinext-test-gate.mjs
  • tests/act.test.tsx
  • tests/action-runtime-copies.test.tsx
  • tests/actions.test.tsx
  • tests/activity-transition.test.tsx
  • tests/cloudflare-integration.test.ts
  • tests/commit-fiber-restoration.test.ts
  • tests/commit-hook-snapshots.test.ts
  • tests/commit-plan.test.ts
  • tests/commit-staging.test.tsx
  • tests/devtools-react-parity.test.ts
  • tests/disabled-hydration.test.ts
  • tests/document-shell.test.tsx
  • tests/effect-checkpoints.test.ts
  • tests/effect-drain.test.ts
  • tests/event-parity.test.tsx
  • tests/extension-capabilities.test.tsx
  • tests/external-store-selector.test.tsx
  • tests/fast-refresh.test.tsx
  • tests/find-dom-node.test.tsx
  • tests/flight-timing.test.ts
  • tests/lazy-wrapped-components.test.tsx
  • tests/next-browser-errors.test.ts
  • tests/next-cache-loader.test.ts
  • tests/next-config.test.ts
  • tests/next-coverage-report.test.ts
  • tests/next-document-hydration.test.tsx
  • tests/numeric-styles.test.tsx
  • tests/public-exports.test.ts
  • tests/react-ids.test.tsx
  • tests/react-streaming.test.tsx
  • tests/resource-url.test.ts
  • tests/root-suspension.test.tsx
  • tests/security.test.tsx
  • tests/select-defaults.test.tsx
  • tests/server-escape.test.ts
  • tests/server-walk-state.test.ts
  • tests/thenable-children.test.tsx
  • tests/transition-queue-regression.test.tsx
  • tests/transition-reentrant-queue.test.tsx
  • tests/transition-retention.test.tsx
  • tests/vinext-browser-errors.test.ts
  • tests/vinext-compatibility.test.ts
  • tests/vinext-config.test.ts
  • tests/vinext-consumer.test.ts
  • tests/vinext-coverage-report.test.ts
  • tests/vinext-optimizer.test.ts
  • tests/vinext-package-snapshot.test.ts
  • tests/vinext-pages-coverage-report.test.ts
  • tests/vite-plugin.test.ts

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Oct 25, 2026 •

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
High priority
High CVE: npm undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

CVE: GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (HIGH)

Affected versions: >= 6.23.0 < 6.29.1; >= 7.18.0 < 7.30.1; >= 8.0.0 < 8.12.2

Patched version: 7.30.1

From: packages/redact/vendor/cloudflare-vite-plugin/package.json → npm/@cloudflare/workers-utils@0.48.0 → npm/miniflare@5.20261019.2-beta → npm/undici@7.29.1

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
High CVE: Vite: server.fs.deny bypassed with queries

CVE: GHSA-v2wj-q39q-566r Vite: server.fs.deny bypassed with queries (HIGH)

Affected versions: >= 8.0.0 < 8.0.5; >= 7.1.0 < 7.3.2

Patched version: 7.3.2

From: packages/redact/vendor/cloudflare-vite-plugin/package.json → npm/vite@7.1.12

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
High CVE: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

CVE: GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket (HIGH)

Affected versions: >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.3.2; >= 6.0.0 < 6.4.2

Patched version: 7.3.2

From: packages/redact/vendor/cloudflare-vite-plugin/package.json → npm/vite@7.1.12

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
High CVE: Zod can exhaust memory while validating oversized constrained collections

CVE: GHSA-mrhx-c7xc-m3w5 Zod can exhaust memory while validating oversized constrained collections (HIGH)

Affected versions: < 4.6.6

Patched version: 4.6.6

From: packages/redact/vendor/cloudflare-vite-plugin/package.json → npm/@cloudflare/containers-shared@0.23.2 → npm/zod@4.6.5

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/zod@4.6.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@tannerlinsley
tannerlinsley merged commit f0894a2 into main Oct 25, 2026
60 checks passed
Comment thread docs/vinext.md

Vite's alias table is shared across environments. The adapter uses environment-specific resolution hooks so native server React and Flight remain intact. It uses the full Redact renderer. The separate Vite plugin's feature presets do not apply.

The adapter also keeps Vinext's Next shims out of server and App Router dependency prebundling, so router state has one module identity. Pages-only clients retain their prebundled pipeline, with shared instrumentation state. A version-scoped transform prevents Pages JSON requests from receiving document trailing-slash redirects. The development Flight profiler also validates end times and track indices for errors and cancellations, matching React's completed-component track. Valid measurements and application errors remain intact. These corrections run through Vite's normal plugin hooks, including its separate optimizer, and leave installed Vinext files intact.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a heads up that I've published the release that contains these fixes.

@github-actions github-actions Bot mentioned this pull request Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants