⌘K
Pauline P. Narvas Hey Dorian! 🎉 Huge congrats on being accepted into the Vercel OSS Program 2025 Spring Cohort. That’s amazing! It’s been so cool to see Kokonut UI grow from a personal project into something that’s genuinely supporting the broader Next.js and React community. The integrations with both the shadcn/ui CLI and v0 sound incredibly useful, especially for folks who want to prototype and customize components quickly. And honestly, being one of the first to figure out the shadcn CLI integration without any docs? That’s some serious dedication. 👏 Thank you for sharing this with the community and for eve
Dominik Koch Oh wow these components look amazing. I think the Apple Activity Card is my favorite. Any chance you could make a gauge version of that? Something like this would be sick:
Jacob Paris Upgrading Next alone is ok to make you safe from the React2Shell exploit Next.js bundles React internally on the server-side, and that contains the portion of React that had the vulnerability, so upgrading Next is all that's needed. It's possible to have a Next.js app that has no react dependency in its package.json at all, which is why two separate CVEs were issued: one for react, and one for the bundled version of React inside Next.js. Modern developer tooling requires the package.json to specify all dependencies that are referenced in code, so having react in your package.json is normal, bu
farzigalib Thanks, that makes sense. I have one more doubt — what if I manually update react and react-dom to the patched versions anyway? Would that cause any issues or is it completely optional since Next already bundles the secure version internally? Also, I’m using several other React-based npm packages in my project, such as: react-beautiful-dnd: 13.1.0 react-datepicker: 6.1.0 react-dropzone: 14.2.3 react-fast-marquee: 1.6.2 react-google-recaptcha-v3: 1.10.1 react-multi-carousel: 2.8.4 react-xls: 0.1.1 …and many more. Is there a recommended way to confirm whether all these third-party packages are s
