Search posts, papers, and topics
This article details building a Generative UI architecture that streams structured JSON component schemas from LLMs, rendering them directly into type-safe React Server Components. It provides a full, from-scratch implementation using Web Streams, Zod, and Next.js 15+, avoiding proprietary libraries.
Hacktron reported an RCE in libheif, an AVIF decoder used by Next.js image optimization. Vercel and Hacktron reproduced the issue, then coordinated with upstream maintainers (sharp, libvips, libheif) to deploy platform-wide mitigations and release fixes across the ecosystem.
Server‑only code can silently inflate client bundles in Next.js 15+ apps. The article shows how to spot leaks with @next/bundle-analyzer, prevent them by removing shared barrel files or adding the `server-only` guard, and enforce a deny‑list of server modules via a custom ESLint rule that scans the AST of files with a `'use client'` directive. The rule is wired into a CI bundle‑budget check using…
A step‑by‑step tutorial showing how to protect a high‑impact admin action (resetting all scores) in a Next.js app with Auth0 by combining role checks and a fresh MFA step‑up flow, including helper utilities, session claim preservation, and a hardened API endpoint.
Vercel added full support for Next.js 16.3, bringing leaner prefetching, immutable static assets, and faster route metadata handling. Early adopters see up to 45% fewer prefetches, 24% less static traffic, and roughly 2× faster routing at scale.
Vercel now ships ISR page metadata together with the page files, removing a separate upload step. This reduces deploy times by up to a third for apps that have many ISR or partially prerendered pages, with no extra configuration needed.
