The HTML parser treats </script> (and </style>) as the end of the
containing element regardless of JavaScript/CSS string context. When
dangerouslySetInnerHTML content contained these sequences, the SSR
output could produce malformed HTML where the tag boundary was broken.
Add escapeInlineContent() that replaces </script and </style with
<\/script and <\/style (case-insensitive). Apply it in:
- next/script: beforeInteractive SSR path
- next/head: reactElementToHTML for script and style tags
Includes 14 tests covering the escaping helper, Script component SSR,
and Head component SSR.
The .vite/ directory in the client build output contains build manifests
(ssr-manifest.json, manifest.json) that should not be publicly
accessible. The tryServeStatic() function now rejects requests to
.vite/ paths after URL decoding, which also handles encoded variants
like /%2Evite/.
* fix: apply headers, cookies, and status set by getServerSideProps to the response
getServerSideProps receives a res object that supports setHeader(),
statusCode, and end(). Previously, any headers, cookies, or status
codes set on this object were silently discarded in the final HTML
response.
This fixes two code paths:
1. Production (index.ts renderPage): Capture the res object from
createReqRes and merge its accumulated headers, cookies, and
status into the final Response. Also handle the short-circuit
case where gSSP calls res.end() directly.
2. Dev server (dev-server.ts): Preserve res.statusCode set by gSSP
so it flows through to streamPageToResponse. Also detect when
gSSP calls res.end() to avoid writing to an already-ended stream.
Added getHeaders() and headersSent to the mock res object in
createReqRes so callers can read accumulated response metadata.
Test: Added fixture pages (ssr-headers.tsx, ssr-res-end.tsx) and
integration tests verifying custom headers, cookies, status codes,
and res.end() short-circuit behavior.
* refactor: explicitly forward gSSP headers in dev server
Address review feedback:
- Capture headers newly set by gSSP via snapshot/diff and forward them
explicitly through extraHeaders, instead of relying on Node.js
writeHead() implicitly merging setHeader() calls. This prevents
silent header loss if streamPageToResponse is refactored.
- Support array-valued headers (e.g. multiple Set-Cookie) in
streamPageToResponse by using res.setHeader() for arrays.
- Add comments explaining the middleware header behavior when gSSP
calls res.end() (dev includes them via the shared res object,
prod merges them via the worker entry).
* fix: throw when headers()/cookies()/connection() called inside cache scope
Next.js throws errors when dynamic request APIs (headers(), cookies(),
connection()) are called inside "use cache" or unstable_cache() scopes.
This is because cached results are shared across requests, so reading
request-specific data inside a cache scope would freeze one user's data
into the cache and return it to all subsequent callers.
This change adds the same guards:
- headers() and cookies() in next/headers now check if the current
execution is inside a "use cache" or unstable_cache() ALS scope
- connection() in next/server does the same check
- unstable_cache() wraps its callback in an ALS scope so the guard
can detect it
- The "use cache" runtime's cacheContextStorage is stored on globalThis
via a well-known Symbol so headers.ts can read it without circular
imports
Includes 9 regression tests covering all combinations of APIs and
cache scope types, plus a test verifying normal operation outside
cache scopes.
* fix: add draftMode() cache scope guard, remove dead code, add nested scope test
Address review feedback:
- Add throwIfInsideCacheScope() guard to draftMode() since it reads
per-request cookies and mutates state via enable()/disable()
- Remove dead isInsideCacheScope export from cache-runtime.ts (never
imported, headers.ts re-implements via globalThis Symbol lookup)
- Add tests for draftMode() in both "use cache" and unstable_cache scopes
- Add nested scope test (unstable_cache inside "use cache")
* fix: validate request origin in dev server before Vite serves content
The dev server origin check middleware was registered after Vite's
built-in file-serving middleware, so requests to internal paths
(/@*, /__vite*, /node_modules*) were served before any validation.
- Register origin check directly in configureServer body (pre-middleware)
so it runs before Vite serves source files or internal endpoints
- Restrict CORS origin to localhost variants (127.0.0.1, [::1], *.localhost)
- Add Sec-Fetch-Site: cross-site check as defense-in-depth
- Block image endpoint redirects to internal Vite paths (/@*, /__vite*,
/node_modules*)
- Add regression tests for both App Router and Pages Router dev servers
* refactor: use shared validateDevRequest() in pre-Vite middleware
Address review feedback:
- Replace inline origin-check logic with validateDevRequest() call to
maintain a single source of truth (includes x-forwarded-host,
allowedDevOrigins, and *.localhost support)
- Fix misleading Sec-Fetch-Site test in app-router.test.ts: use node:http
instead of fetch() which strips Sec-Fetch-* forbidden headers
- Add defense-in-depth comment on the redundant Pages Router check
* fix: static-prefix routes not outranking dynamic catch-alls in route scoring
* share route precedence logic between app and pages router
* fix(routing): static-prefix boost collapsed infix-static ordering to a tie
* extra comment
* fix: config redirects not applying to rsc requests
* fix poorly written test
* add better fix for soft nav url diffs
* escape the .
* fix: strip .rsc from beforeFiles rewrites; fix redirect recursion and double pushState
* fix: apps with both app + pages router returning 404s
* apply same fix for api routes
* test for pages dir route
* always filter x-middleware headers, and preserve others on redirect
* fix(app-router): avoid React 19 dev Flight decode crash in SSR (#50)
* fix(app-router): avoid React 19 dev Flight decode crash in SSR (#50)
* test(ecosystem): harden fixture cleanup and isolate better-auth signup data
* chore: address review nits on React 19 dev Flight decode fix
- Convert standalone JSDoc block to plain // comment to avoid confusion
with the adjacent createRscEmbedTransform JSDoc
- Add note that VinextFlightRoot returns a thenable (not ReactNode),
relying on React 19's internal thenable-as-child behavior
- Add comment noting the 'Switched to client rendering' assertion
depends on React internal message text
- Clarify error.tsx fixture exists for realistic route structure, not
because the error boundary fires during SSR
- Merge main into branch
---------
Co-authored-by: root <root@localhost.localdomain>
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
* fix(rsc): emit actionable hint when non-plain object crosses server-client boundary
When a Server Component passes a class instance, ESM module namespace
object, or null-prototype object as a prop to a Client Component,
React's RSC serializer throws "Only plain objects, and a few built-ins,
can be passed to Client Components from Server Components." In dev mode
this error previously surfaced in the browser with no indication of
which component or prop triggered it, making it hard to debug in large
apps.
Add a console.error in rscOnError that detects this specific error and
prints an actionable guide explaining the four common causes, including
the key ESM vs webpack difference: Vite produces true ESM module
namespace objects (non-serializable), while Next.js webpack produces
plain __esModule objects (serializable) — causing code to silently work
in plain Next.js but correctly fail in vinext.
* test(rsc): add unit tests for rscOnError non-plain object dev hint
Verify that the generated RSC entry code produced by generateRscEntry
includes the dev-mode hint for issue #237. Tests cover:
- Detection string for "Only plain objects" error is present
- Hint is guarded by NODE_ENV !== "production"
- Actionable guidance for module namespace objects is included
- Actionable guidance for class instances is included
- Existing digest return path for navigation errors is unaffected
* fix: escape newlines in rscOnError hint and add runtime tests
- Double-escape \n in the console.error hint strings so the generated
JavaScript output contains valid string literals (the single-escaped
\n was resolved to literal newlines by the template literal, producing
unterminated strings that broke production builds).
- Add explicit 'return undefined' after the hint console.error block.
- Add runtime tests that extract rscOnError from the generated code via
new Function() and verify: digest passthrough for navigation errors,
console.error hint for RSC serialization errors, and undefined return
for generic dev errors.
---------
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
* fix: register MDX plugin at top level to fix transform ordering
Plugins returned from the config() hook run after vite:import-analysis,
so @mdx-js/rollup transforms never fire. Move MDX to a top-level proxy
plugin with enforce:"pre" that delegates to the lazily-created MDX
instance once config() populates it.
Fixes#77
* address review: add config proxy, remove dead resolveId, fix comment separation
- Replace resolveId proxy with config proxy: @mdx-js/rollup has no
resolveId hook, but its config() hook initializes format-aware
processors with the Vite mode (development vs production). Without
forwarding config(), MDX always compiles in production mode.
- Remove dead resolveId proxy (dead code, @mdx-js/rollup has no such hook)
- Separate MDX proxy comment from vinext:react-canary comment
- Update test to verify config and transform hooks on the proxy
* add E2E test for MDX import transform ordering
A regular page.tsx imports content.mdx as a React component and
renders it. This verifies the vinext:mdx proxy plugin transforms
.mdx files before vite:import-analysis runs (the core fix from #77).
---------
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
Add wrapWithRouterContext() function to the next/router shim that wraps
any React element in a <RouterContext.Provider>. This is the root-cause
fix: it builds the router value object directly from the SSR context
(server) or window.location + Router singleton (client) — no hooks, no
duplicate state, no extra component.
This provides a single source of truth for the router context value,
matching how Next.js provides RouterContext at the framework level.
Wrapping sites:
- dev-server.ts: main render, ISR re-render, error page render
- index.ts virtual module: production renderPage and ISR re-render
- Hydration script: client-side hydration entry
- navigateClient: client-side navigation re-renders
Tests:
- useRouter returns null without provider (default/App Router)
- useRouter returns full router when wrapWithRouterContext wraps tree
- useRouter reflects SSR context (pathname, query, asPath)
- wrapWithRouterContext is exported from next/router
Closes#239
* fix: set NODE_ENV
* address review feedback: readability, test coverage, and nextConfig.env guard
- Replace nested ternary with if/else for NODE_ENV resolution
- Add comment explaining why beforeEach/afterEach is file-scoped
- Add test cases: serve (development), build without mode, user override
- Skip NODE_ENV key in nextConfig.env loop to prevent silent override
- Extract setupTmpProject helper to reduce test boilerplate
---------
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
* fix(shims): add missing URL setters to NextURL
The NextURL class only had setters for pathname, search, and hash, leaving
port, host, hostname, protocol, href, username, and password as getter-only.
Libraries like next-intl's getAlternateLinksHeaderValue clone nextUrl then set
.port and .host to normalise the URL for alternate-link headers. In Cloudflare
Workers, x-forwarded-host is always present, so this code path is always
triggered, producing:
TypeError: Cannot set property port of [object Object] which has only a getter
Add setters for all writable URL properties so NextURL behaves identically to
the platform URL class.
Fixes runtime middleware errors when using next-intl in production on Workers.
* revert build artifact to main (remove local machine paths)
---------
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
Wire ServerInsertedHTMLContext into the SSR pipeline so libraries like
Apollo Client, styled-components, and emotion that use
useContext(ServerInsertedHTMLContext) get a working callback registration
function during SSR.
Changes:
- Add ServerInsertedHTMLContext export to navigation.ts (single shared
context, RSC-safe with null fallback)
- Wrap SSR rendered tree with ServerInsertedHTMLContext.Provider in
handleSsr() — the provider value is useServerInsertedHTML itself, so
both direct callers and useContext() callers push to the same
ALS-backed callback array
- Add TypeScript declaration in next-shims.d.ts
- Add 8 integration tests verifying the actual Apollo Client pattern
(useContext returns a usable callback, callbacks are flushed correctly)
Addresses review feedback from #151:
- Single context (no dead getServerInsertedHTMLContext)
- Provider wired into SSR pipeline (not disconnected)
- Tests verify real integration behavior, not React internals
* fix: lowercase package name before sanitizing Worker name
* test: assert exact sanitized project name value
Strengthen the sanitization test to assert the exact expected value
('my-app-v2') instead of just matching a regex pattern. The regex
assertion passed even when the bug was present.
---------
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
* fix(init): detect bun and invoking package manager reliably
* refactor: address review feedback on detectPackageManagerName
- Combine bun.lock/bun.lockb checks into block form for consistency
with the npm lockfile check
- Accept optional env parameter (defaults to process.env) so the
function can be unit-tested without mutating global state
---------
Co-authored-by: root <root@localhost.localdomain>
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
* feat: add /dist/ to .gitignore during vinext init
vinext build outputs to /dist/ which should not be committed.
The init command now ensures /dist/ is in .gitignore, creating
the file if needed and skipping if the entry already exists.
* fix: broaden .gitignore duplicate check to cover dist/ and dist variants
Address review feedback: detect dist/ (no leading slash) and bare dist
as existing coverage for the dist directory to avoid adding a redundant
/dist/ entry. Rename entry -> exactEntry for clarity.
Closes#228. vinext was not loading .env files, so environment variables
defined in .env were unavailable to server-side code (getServerSideProps,
API routes, server components) and NEXT_PUBLIC_* vars were missing from
the client bundle defines.
Uses Vite's loadEnv() in the config hook with an empty prefix to load
all .env vars (not just VITE_-prefixed) into process.env before
loadNextConfig() runs, matching Next.js behavior.
SVGs are auto-skipped on the client side (set unoptimized=true) unless
dangerouslyAllowSVG is enabled in next.config. When dangerouslyAllowSVG
is true, SVGs that reach the server are passed through without
transformation, with security headers (CSP, Content-Disposition)
applied.
Config options added to NextConfig.images:
- dangerouslyAllowSVG (default: false)
- contentDispositionType (default: "inline")
- contentSecurityPolicy (default: "script-src 'none'; frame-src 'none'; sandbox;")
Co-authored-by: Dhruv Sharma <dhruvcoding67@gmail.com>
* Skip deploy previews for fork PRs that lack Cloudflare secrets
Fork PRs don't have access to repository secrets (CLOUDFLARE_API_TOKEN,
CLOUDFLARE_ACCOUNT_ID), so deploy/smoke-test/comment steps always fail.
Add a fork detection condition to skip these steps gracefully. The build
steps still run, so example builds are still validated for fork PRs.
* test: add ShadCN/Radix UI ecosystem coverage
Add ecosystem integration tests for ShadCN components backed by Radix UI
primitives. This ensures we don't regress on a popular library combination.
The fixture tests:
- Button (server component) using @radix-ui/react-slot without "use client"
- Dialog ("use client") using @radix-ui/react-dialog with createContext
- DropdownMenu ("use client") using @radix-ui/react-dropdown-menu
Ref: #100
In Cloudflare Workers, Request.headers is immutable per the Fetch API spec.
headersContextFromRequest was storing the original request.headers reference
directly in HeadersContext, so when applyMiddlewareRequestHeaders later called
ctx.headers.set() (to propagate middleware-modified headers like x-request-url
into the server component context), Workers threw:
TypeError: Can't modify immutable headers.
Fix by wrapping with new Headers(request.headers), which creates an independent
mutable copy while preserving all header values.
Patterns like `/:slug.md` were falling through to the simple segment
matcher, which treated `slug.md` as the entire parameter name and
matched any single-segment path (including `/`). This caused rewrites
like `{ source: "/:slug.md", destination: "/api/markdown/:slug" }` to
rewrite every page request, resulting in 404s.
Add `/:[\w-]+\./.test(pattern)` to the condition that triggers the
regex-based matcher, which already tokenizes `:slug` + `.` + `md`
correctly.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Next.js always has request context when evaluating has/missing
conditions on headers, redirects, and rewrites. There is no code path
where these are evaluated without a request.
Making ctx required eliminates ambiguity about what happens when
context is missing, and surfaces any future call sites that forget
to pass it as compile-time errors instead of silent behavioral bugs.
Also fixes deploy.ts matchHeaders call that was missing reqCtx.
Co-authored-by: Eray <erayackgoz@gmail.com>
Add integration tests for has/missing conditions on next.config.js
headers in the Pages Router, covering both dev and production servers.
The implementation was merged in #48 but lacked Pages Router test
coverage.
Co-authored-by: Bruno Maciel <ibruno@users.noreply.github.com>
* fix: throw on missing middleware/proxy exports instead of failing open
Middleware and proxy files that don't export the expected function
(e.g. misspelled export, wrong named export) were silently skipped,
letting requests through unprotected. This matches Next.js behavior
which throws a ProxyMissingExportError in the same scenario.
Changes:
- proxy.ts files now require 'proxy' or 'default' export
- middleware.ts files now require 'middleware' or 'default' export
- All 3 code paths updated (Pages dev, Pages prod, App Router)
- Added resolveMiddlewareHandler() with file-type-aware validation
- Ported test cases from Next.js proxy-missing-export test suite
- Updated AGENTS.md: added required step to search Next.js tests
Ported from Next.js: test/e2e/app-dir/proxy-missing-export/
https://github.com/vercel/next.js/blob/canary/test/e2e/app-dir/proxy-missing-export/proxy-missing-export.test.ts
* fix: update export precedence test to match Next.js behavior (named > default)
* fix: use ?? instead of || in generated middleware export resolution for consistency
Matches the shared resolveMiddlewareHandler() which uses nullish
coalescing. No behavioral difference since typeof check catches
all cases, but keeps the three code paths consistent.
* fix(config): respect has/missing conditions in next.config headers
Adds has/missing condition support to matchHeaders, wires request context
through dev/prod paths, updates NextHeader types, and adds unit + e2e tests
for header/cookie/query conditions.
* chore: add backward-compat comment for optional ctx in matchHeaders
Addresses review feedback: clarify that when no request context is
passed, has/missing conditions are silently skipped for backward
compatibility with existing callers.
* fix: wire has/missing conditions through redirects and rewrites in Pages Router dev
Pages Router dev was the only path missing has/missing support for
redirects and rewrites. The reqCtx was already being built for headers,
so hoist it and pass it to applyRedirects and applyRewrites too.
Also refactors applyRedirects and applyRewrites to delegate to the
shared matchRedirect/matchRewrite functions, eliminating duplicated
pattern-matching logic (same dedup pattern used for applyHeaders).
---------
Co-authored-by: tomoconstrutor <tomoconstrutor@gmail.com>
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
* feat: add CJS support via vite-plugin-commonjs
Add vite-plugin-commonjs to handle require() and module.exports in
both App Router and Pages Router. This enables CJS interop in server
components and pages, including CJS require('server-only') boundary
enforcement by @vitejs/plugin-rsc.
- Add vite-plugin-commonjs as a dependency and register it in the plugin array
- Add App Router fixtures: CJS basic, CJS server-only, CJS server-only
violation (client component importing server-only module)
- Add Pages Router fixture: CJS basic (require/module.exports)
- Add integration tests for both routers (cjs.test.ts)
- Add App Router e2e tests for CJS rendering and server-only boundary
enforcement (tests/e2e/app-router/cjs.spec.ts)
- Add Pages Router e2e test for CJS rendering
(tests/e2e/pages-router/cjs.spec.ts)
* fix: use buildViteConfig() for Pages Router production builds
The Pages Router build path hardcoded plugins: [vinext()] in inline
config, duplicating plugins when a vite.config.ts also registers
vinext(). This caused double-transformation errors during production
builds. Use buildViteConfig() instead, matching the App Router path
which already handles this correctly.
* fix: move server-only-violation fixture to isolated directory
The server-only-violation fixture causes a fatal build error during
production builds of app-basic (the RSC plugin rejects the intentional
violation). This breaks unrelated tests in app-router.test.ts.
Move the fixture to tests/fixtures/app-cjs-violation/ so it doesn't
poison the shared app-basic production build. Remove the E2E test case
since it requires the app-basic dev server; the server-only boundary
enforcement for CJS require() is verified by the RSC plugin's build
validation.
* fix: address review feedback from bonk
- Remove unused components/random.tsx (dead code, Pages Router CJS test
uses pages/cjs/random.ts instead)
- Add trailing newlines to fixture files
- Move commonjs() plugin earlier in array (after tsconfigPaths, before
vinext:config) so CJS->ESM transform runs before directive scanning
- Tighten test assertions: use regex for 'Random:.*4' to be specific
while handling React SSR comment nodes between text and expressions
---------
Co-authored-by: Steve Faulkner <sfaulkner@cloudflare.com>
* fix: bound fetch cache key body serialization
* Safeguard cache key serialization from large bodies
Bump cache key version to v2 and add safeguards to serializeBody to avoid OOM when processing large request bodies. Track cumulative raw byte size of streamed chunks and throw BodyTooLargeForCacheKeyError when exceeding the 1 MiB limit, call reader.cancel on errors, and add a cheap string-length pre-check. Adds tests covering oversized Uint8Array, string, multi-chunk ReadableStream, and FormData/File cases to verify such requests bypass the cache and still perform fetches.
---------
Co-authored-by: Sunil Pai <spai@cloudflare.com>
* fix: preserve middleware request override headers in runMiddleware
* Strip x-middleware-* headers, detect bun, update fixtures
Preserve and unpack x-middleware-request-* headers while removing any other x-middleware-* headers in the worker entry (defense-in-depth). Add bun package manager detection in project utils (detectPackageManager and detectPackageManagerName). Update tests to assert the new header-stripping behavior. Update pages-basic fixture entry: add explicit void for promise calls, inject a middleware header override route, add dangerous-scheme blocking for Link hrefs, include credentials on prefetch, update dynamic import asset names and file metadata, and rename several getServerSideProps helper identifiers to avoid collisions.
* Normalize absolute file paths in fixture
Update fileName annotations in tests/fixtures/pages-basic/dist/server/entry.js to replace local developer paths (/Users/sunilpai/...) with CI runner paths (/home/runner/work/...). This cleans up generated JSXDEV metadata in the compiled test fixture to avoid leaking local machine paths and make outputs reproducible.
---------
Co-authored-by: Sunil Pai <spai@cloudflare.com>
* Skip deploy previews for fork PRs that lack Cloudflare secrets
Fork PRs don't have access to repository secrets (CLOUDFLARE_API_TOKEN,
CLOUDFLARE_ACCOUNT_ID), so deploy/smoke-test/comment steps always fail.
Add a fork detection condition to skip these steps gracefully. The build
steps still run, so example builds are still validated for fork PRs.
* fix: align Pages Router worker entry with prod-server request handling
The generated Cloudflare Worker entry for Pages Router apps was missing
several request handling steps that the Node.js production server
(prod-server.ts) already handled. This brings the two in sync:
- Run middleware (runMiddleware) before routing
- Apply next.config.js redirects, rewrites (before/after/fallback), and headers
- Handle basePath stripping and trailing slash normalization
- Merge middleware response headers with correct precedence
- Guard renderPage with typeof check
Also updates the two Pages Router examples (pages-router-cloudflare,
realworld-api-rest) and exports vinext/config/config-matchers so the
worker entry can import the shared matching utilities.
* chore: sync pnpm-lock.yaml with upstream package.json changes
These tests intentionally use new Function() to evaluate generated
middleware codegen output. Add eslint-disable-next-line comments to
fix --deny-warnings CI failures.
* fix: use static import for renderToStaticMarkup to eliminate dual-import warning
The generated SSR entry imported renderToReadableStream statically from
react-dom/server.edge at the top level, but later used a dynamic
import() for renderToStaticMarkup from the same module. Rollup detects
this mixed static+dynamic import pattern and emits a warning for every
build:
"react-dom/server.edge" is imported as both a static and dynamic
import in the same module
Fix: add renderToStaticMarkup to the existing static import, removing
the redundant dynamic import(). The module was already loaded — the
dynamic import added no lazy-loading benefit since it runs
unconditionally during SSR.
* Remove comment on renderToStaticMarkup import
Removed comment about static import of renderToStaticMarkup.
* Remove unneccesary test
---------
Co-authored-by: Fred K. Schott <622227+FredKSchott@users.noreply.github.com>
Config matchers (redirects, rewrites, headers) now receive the decoded,
normalized pathname so that percent-encoded request paths like /%61bout
correctly match config rules defined for /about.
Both dev and prod servers rebuild the working URL from the decoded
pathname + original query string, ensuring all downstream consumers
operate on canonical paths.
Also adds unit and integration tests for percent-encoded path handling
in config matchers across App Router and Pages Router (dev + prod).
Strip all x-middleware-* prefixed headers from responses in both the
App Router and Pages Router dev servers before sending to clients.
These headers are internal routing signals (x-middleware-next,
x-middleware-rewrite, x-middleware-override-headers, etc.) and should
not be visible to end users.
The prod server already stripped these correctly. This brings the dev
servers into parity.
Ensures the pathname is decoded exactly once (via decodeURIComponent +
normalizePath) at the request entry point, and all downstream consumers
(middleware, config matchers, route matching) receive the same canonical
path. Previously, some code paths decoded the pathname a second time,
which could cause inconsistent matching between middleware and routing.
Also removes redundant decodeURIComponent calls from matchRoute and
matchConfigPattern catch-all branches that are no longer needed since
the caller now guarantees a pre-decoded pathname.
* fix: fetch cache key generation — handle all body types, include all headers minus blocklist
- Make buildFetchCacheKey async to support stream/blob body serialization
- Handle all BodyInit types: string, Uint8Array, ReadableStream, FormData, Blob, URLSearchParams
- Switch header strategy from allowlist (3 auth headers) to blocklist (traceparent/tracestate), matching Next.js
- Include RequestInit fields (mode, redirect, credentials, etc.) in cache key
- SHA-256 hash the cache key for compact, deterministic storage
- Fix spent stream bug: restore _ogBody in stripNextFromInit so originalFetch gets usable body
- Add 19 new tests covering body types, header inclusion, body restoration, and URLSearchParams
* Improve fetch cache key generation
Replace simple auth-header extraction with a unified header collector, add a header blocklist and cache version prefix, and introduce async cache key building. serializeBody now handles various body types (Uint8Array, streams, URLSearchParams, FormData, Blob, string), preserves the original body on init._ogBody, and body content is included in the cache key. The cache key is generated by normalizing URL, method, headers and init options and hashing them with SHA-256. buildFetchCacheKey is now async and awaited where used, and stripNextFromInit restores the preserved original body. Also add hasAuthHeaders and move auth header list into a constant.
* PR #111 approved. 52 tests pass, 3 fixes correct.
Co-authored-by: threepointone <threepointone@users.noreply.github.com>
---------
Co-authored-by: ask-bonk[bot] <ask-bonk[bot]@users.noreply.github.com>
Co-authored-by: threepointone <threepointone@users.noreply.github.com>
Syncs the checked-in build artifact with current source. Notable
changes: middleware runner now wraps decodeURIComponent in try/catch,
jsx-dev-runtime switched to jsx-runtime for production build.
Wrap all decodeURIComponent calls on user-controlled URL paths in
try/catch to return 400 Bad Request instead of throwing an uncaught
URIError that crashes the Node process.
A single request with a malformed percent-encoded path (e.g. /%E0%A4%A)
could terminate the entire server process. This affected all server
entry points: prod server (App + Pages Router), dev server middleware,
Cloudflare Worker entry, and generated RSC/middleware handlers.
Fixes:
- prod-server.ts: App Router and Pages Router request handlers
- app-router-entry.ts: Cloudflare Worker entry
- app-dev-server.ts: Generated RSC entry handler
- index.ts: Dev server connect middleware + generated middleware runner
+ generated NEXT_LOCALE cookie parser
- middleware.ts: Pages Router dev middleware runner
Includes 11 regression tests across app-router, pages-router, and
features test suites.
* fix: close security gaps in init.ts shell exec and app-dev-server external proxy
Gap 1 (GHSA-w7vc-6jjg-498h): migrate init.ts from execSync to execFileSync
with argument array, matching the pattern already applied in deploy.ts and
cli.ts. Inputs are hardcoded package names so practical risk is near zero,
but this eliminates the last instance of the flagged pattern.
Gap 2 (GHSA-pf96-3m7r-pv3j): harden the inline __proxyExternalRequest in
the generated RSC entry (app-dev-server.ts) to strip Cookie, Authorization,
x-api-key, proxy-authorization, and all x-middleware-* headers before
forwarding to external rewrite targets. Also adds a 30-second
AbortSignal.timeout. This brings the dev-server code path into parity with
the already-fixed proxyExternalRequest in config-matchers.ts.
Also fixes a missed GSP redirect path in dev-server.ts where backslash
normalization was not applied (GHSA-79rw-r8hc-qg8v — the GSSP path was
already committed).
Includes an integration test that verifies credential stripping end-to-end
via a mock HTTP server and a conditional external rewrite in next.config.ts.
* fix: unify isExternalUrl to detect all URL schemes and protocol-relative URLs
All four copies of isExternalUrl (config-matchers.ts, router.ts,
navigation.ts, app-dev-server.ts inline) now use the same RFC 3986
scheme regex: /^[a-z][a-z0-9+.-]*:/i.test(url) || url.startsWith('//')
Previously:
- config-matchers.ts and app-dev-server.ts only checked http:// and
https:// (missing // protocol-relative)
- router.ts and navigation.ts checked http://, https://, and // but
missed exotic schemes (data:, javascript:, blob:, ftp:, etc.)
Now all copies are consistent and detect any URL scheme per RFC 3986
plus protocol-relative URLs.
Adds test cases for exotic schemes, protocol-relative, hash-only, and
bare string inputs.
* fix: add shell: true to execFileSync for Windows .cmd file compat
On Windows, package managers (pnpm, npm, yarn) are .cmd batch files.
execFileSync without shell: true cannot execute them. Adding shell: true
lets the OS shell resolve .cmd files while still using the argument array
form for safer argument passing.
Steve Faulkner