* Enhance PromptInput with referenced sources functionality
- Added support for managing referenced sources within the PromptInput component.
- Introduced new context and hooks for handling referenced sources.
- Implemented UI components for displaying and interacting with referenced sources.
- Updated example to demonstrate the usage of referenced sources in the PromptInput.
* Implement SourceDocument functionality in PromptInput component
* Refactor PromptInput component to improve attachment and referenced source management
- Consolidated attachment clearing logic into a single clear function.
- Enhanced readability by restructuring JSX elements and type definitions.
- Added a new clearReferencedSources function for better state management.
---------
Co-authored-by: Hayden Bleasel <hello@haydenbleasel.com>
The mcp-handler package internally depends on @modelcontextprotocol/sdk@1.22.0,
which uses zod-to-json-schema that is incompatible with Zod 4. This caused
the `component` parameter in `get_ai_elements_component` tool to not be
exposed in the inputSchema (empty properties object).
Changes:
- Import zod from "zod/v3" instead of "zod" for backward compatibility
- Replace z.enum() with z.string().describe() for better schema generation
- Improve error message to list available components when not found
Co-authored-by: liuhaitian <liuhaitian@bytedance.com>
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
# React Flight / Next.js RCE Advisory Fix
## Summary
Successfully upgraded Next.js versions in the ai-elements monorepo to address the React Flight / Next.js RCE advisory (CVE-2024-XXX).
## Changes Made
### Affected Packages Identified
The project uses Next.js 16.0.1 in two applications:
- `apps/docs/package.json` - Documentation site
- `apps/registry/package.json` - Component registry site
The project does NOT use any vulnerable React Flight packages directly:
- No `react-server-dom-webpack` dependency
- No `react-server-dom-parcel` dependency
- No `react-server-dom-turbopack` dependency
### Upgrades Applied
Following the advisory guidelines for Next.js 16.x → 16.0.7:
**Modified Files:**
1. `apps/docs/package.json`
- Updated: `"next": "16.0.1"` → `"next": "16.0.7"`
2. `apps/registry/package.json`
- Updated: `"next": "16.0.1"` → `"next": "16.0.7"`
3. `pnpm-lock.yaml`
- Updated lockfile to reflect new Next.js versions and their dependencies
### React Versions
React and react-dom were NOT manually modified, as per the advisory instructions. Next.js 16.0.7 will automatically provide the correct patched React dependency versions.
Current React versions in use:
- `react@19.2.0` and `react-dom@19.2.0` in most packages
- Next.js manages its own React dependencies internally
## Verification
### Dependency Installation
✓ Successfully ran `pnpm install` to update lockfile and install patched versions
✓ All 1168 packages installed successfully
✓ No dependency conflicts detected
### Build Verification
✓ `apps/docs` - Build successful with Next.js 16.0.7
- 121 pages generated successfully
- TypeScript compilation passed
- No runtime errors
✓ `apps/registry` - Build successful with Next.js 16.0.7
- 2 pages generated successfully
- TypeScript compilation passed
- No runtime errors
## Implementation Notes
- This is a monorepo using pnpm as the package manager
- No breaking changes introduced by the Next.js patch version upgrade
- No application code modifications were required
- All existing functionality preserved
- The security patch only affects internal Next.js server component handling
## Advisory Compliance
✓ Detected Next.js usage in the project
✓ Upgraded to patched version for 16.x minor (16.0.7)
✓ Did not upgrade across major versions
✓ Did not manually modify React/React-DOM versions (Next.js handles this)
✓ Updated lockfile and reinstalled dependencies
✓ Verified builds successfully complete
The repository is now protected against the React Flight / Next.js RCE vulnerability.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Hayden Bleasel <hello@haydenbleasel.com>
## React Flight / Next.js RCE Advisory Security Update
Successfully updated the ai-elements monorepo to address the React Flight / Next.js RCE advisory (CVE-2025-XXXXX).
### Summary of Changes
The project was found to be affected by the vulnerability. Two Next.js applications were using vulnerable versions and have been patched.
### Affected Packages Detected
- **apps/docs**: Next.js 16.0.1 → 16.0.7
- **apps/registry**: Next.js 16.0.1 → 16.0.7
Both applications were running Next.js 16.0.1, which is vulnerable to the RCE advisory. According to the security guidance, Next.js 16.x projects must be upgraded to 16.0.7.
### Not Affected
The project does NOT use any of the following vulnerable React Flight packages:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
Other workspace packages (elements, examples, shadcn-ui, cli, typescript-config) do not use Next.js and were not affected.
### Files Modified
1. **apps/docs/package.json** - Updated Next.js from 16.0.1 to 16.0.7
2. **apps/registry/package.json** - Updated Next.js from 16.0.1 to 16.0.7
3. **pnpm-lock.yaml** - Updated lockfile to reflect new Next.js versions
4. **apps/docs/next-env.d.ts** - Auto-generated type definitions updated by Next.js 16.0.7
### Implementation Details
- Used pnpm package manager to install dependencies and update lockfile
- Did NOT manually update React or React-DOM versions (Next.js manages these automatically)
- Followed the advisory guideline: "For Next.js 16.x → set to 16.0.7"
- Did NOT upgrade across major versions (stayed within Next.js 16.x)
### Verification
Both Next.js applications were successfully built with the patched version:
- ✅ `apps/registry` - Build passed (Next.js 16.0.7 with Turbopack)
- ✅ `apps/docs` - Build passed (Next.js 16.0.7 with Turbopack)
All TypeScript compilation and static page generation completed without errors.
### Security Impact
This update patches the React Flight / Next.js RCE vulnerability in both Next.js applications within the monorepo. The patched version 16.0.7 includes critical security fixes that prevent remote code execution attacks.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Hayden Bleasel <hello@haydenbleasel.com>
Hayden Bleasel