⌘K
Pauline P. Narvas Hi, @it-9851! I saw that you replied with a solution but it looks like it was deleted, does that work for you now?
WeGroup Correct, I rephrased the entire question to be more concise and to the point. (And added the solution to the original post) Our solution was to move the vercel.json file to the public folder which gets copied over to vercel. Before: After: Note that the before just worked fine until ~22nd december. As far as we know, we didn't change anything on our side. Everyone on our team looked at this issue. Now everything is OK but we would like some clarity as this behavior is not documented anywhere. In other words, we want to avoid this breaking in the near future.
Pauline P. Narvas Hey Dorian! 🎉 Huge congrats on being accepted into the Vercel OSS Program 2025 Spring Cohort. That’s amazing! It’s been so cool to see Kokonut UI grow from a personal project into something that’s genuinely supporting the broader Next.js and React community. The integrations with both the shadcn/ui CLI and v0 sound incredibly useful, especially for folks who want to prototype and customize components quickly. And honestly, being one of the first to figure out the shadcn CLI integration without any docs? That’s some serious dedication. 👏 Thank you for sharing this with the community and for eve
Dominik Koch Oh wow these components look amazing. I think the Apple Activity Card is my favorite. Any chance you could make a gauge version of that? Something like this would be sick:
Jacob Paris Upgrading Next alone is ok to make you safe from the React2Shell exploit Next.js bundles React internally on the server-side, and that contains the portion of React that had the vulnerability, so upgrading Next is all that's needed. It's possible to have a Next.js app that has no react dependency in its package.json at all, which is why two separate CVEs were issued: one for react, and one for the bundled version of React inside Next.js. Modern developer tooling requires the package.json to specify all dependencies that are referenced in code, so having react in your package.json is normal, bu
farzigalib Thanks, that makes sense. I have one more doubt — what if I manually update react and react-dom to the patched versions anyway? Would that cause any issues or is it completely optional since Next already bundles the secure version internally? Also, I’m using several other React-based npm packages in my project, such as: …and many more. Is there a recommended way to confirm whether all these third-party packages are safe from the current React2Shell vulnerability, or if any of them require updates as well?
