Conversation
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughIntegrated OpenNext Cloudflare support: added Cloudflare-specific config and init, introduced Wrangler configuration, updated package scripts for build/preview/deploy, extended README with Cloudflare deployment steps, and ignored the .open-next build output. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant Next as Next.js Config
participant ONCF as OpenNext Cloudflare
participant WR as Wrangler CLI
participant CF as Cloudflare Workers
participant AS as Static Assets
Dev->>Next: next.config.js loads
Note right of Next: initOpenNextCloudflareForDev()
Next->>ONCF: Initialize dev integration
Dev->>WR: wrangler build/preview/deploy
WR->>ONCF: Use .open-next outputs
ONCF->>AS: Produce .open-next/assets
ONCF->>WR: Produce worker (.open-next/worker.js)
WR->>CF: Upload worker and bind ASSETS
CF-->>Dev: Preview/Deployed URL
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
next.config.js (1)
10-17: Critical: Overly permissive image proxy configuration creates SSRF risk.The wildcard
hostname: "**"allows the Next.js image proxy to fetch from any external URL, which circumvents the SSRF protections in OpenNext Cloudflare >=1.3.0. An attacker could potentially use/_next/imageto access internal services or scan networks.Based on learnings: The OpenNext Cloudflare adapter validates image URLs against
remotePatternsto prevent SSRF attacks. A wildcard hostname defeats this protection.Replace the wildcard with explicit allowed hosts:
images: { remotePatterns: [ { protocol: "https", - hostname: "**", + hostname: "your-cdn-domain.com", + pathname: "/**", }, + // Add additional trusted image hosts as needed ], },If you need to allow multiple domains, enumerate them explicitly rather than using a wildcard.
🧹 Nitpick comments (1)
wrangler.toml (1)
3-3: Consider updating the compatibility_date.The date
2025-03-25is several months old. Using a more recent date (e.g.,2025-10-01) ensures you benefit from the latest Cloudflare Workers runtime features and fixes.Apply this diff:
-compatibility_date = "2025-03-25" +compatibility_date = "2025-10-01"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (6)
.gitignore(1 hunks)README.md(3 hunks)next.config.js(1 hunks)open-next.config.ts(1 hunks)package.json(4 hunks)wrangler.toml(1 hunks)
🧰 Additional context used
🪛 markdownlint-cli2 (0.18.1)
README.md
7-7: Link fragments should be valid
(MD051, link-fragments)
8-8: Link fragments should be valid
(MD051, link-fragments)
9-9: Link fragments should be valid
(MD051, link-fragments)
10-10: Link fragments should be valid
(MD051, link-fragments)
14-14: Link fragments should be valid
(MD051, link-fragments)
15-15: Link fragments should be valid
(MD051, link-fragments)
17-17: Link fragments should be valid
(MD051, link-fragments)
18-18: Link fragments should be valid
(MD051, link-fragments)
19-19: Link fragments should be valid
(MD051, link-fragments)
20-20: Link fragments should be valid
(MD051, link-fragments)
21-21: Link fragments should be valid
(MD051, link-fragments)
22-22: Link fragments should be valid
(MD051, link-fragments)
78-78: Spaces inside code span elements
(MD038, no-space-in-code)
🔇 Additional comments (9)
.gitignore (1)
25-25: LGTM!Appropriately ignores the OpenNext build output directory, consistent with the new Cloudflare deployment workflow.
open-next.config.ts (1)
1-3: LGTM!Standard OpenNext Cloudflare configuration setup. The minimal config allows the adapter to use sensible defaults.
wrangler.toml (1)
1-1: LGTM!The worker path and assets configuration correctly reference the OpenNext build output structure.
Also applies to: 5-7
next.config.js (1)
38-39: Verify that dev-only initialization is appropriate for all builds.The function
initOpenNextCloudflareForDev()is called unconditionally at module load time, including during production builds. Confirm this is the intended pattern for your setup.Based on learnings, this initialization enables features like remote bindings for local development. If this is only needed for dev, consider conditionally calling it:
-import { initOpenNextCloudflareForDev } from "@opennextjs/cloudflare"; -initOpenNextCloudflareForDev(); +if (process.env.NODE_ENV === 'development') { + const { initOpenNextCloudflareForDev } = await import("@opennextjs/cloudflare"); + initOpenNextCloudflareForDev(); +}Verify the correct usage pattern in the OpenNext Cloudflare documentation.
README.md (2)
78-78: Clarify "doesn't work" statement.The note states that
opennextjs-cloudflarefrom official documentation doesn't work. This is unclear and could confuse users. Please clarify:
- What specific issue did you encounter with the official docs?
- Is this a temporary workaround or the recommended approach?
- Should this be reported upstream to the OpenNext Cloudflare project?
Consider rephrasing to be more specific:
2. Run the commands via `wrangler` (`wrangler build`, `wrangler dev`). Note: Use these commands instead of the `opennextjs-cloudflare` CLI if you encounter [specific issue].
73-96: Good addition of deployment documentation.The step-by-step Cloudflare deployment guide is clear and helpful, with proper code examples for each step.
package.json (3)
25-25: LGTM!Using
@opennextjs/cloudflare@^1.9.1is appropriate—this is the latest stable version with important security fixes including SSRF protection for the image proxy.Based on learnings: Version 1.9.1 includes critical security patches and performance improvements.
127-127: LGTM!The Wrangler version
^4.42.0is appropriate for Cloudflare Workers deployment and aligns with the new wrangler.toml configuration.
11-15: Verify script commands work as expected.The new Cloudflare scripts use the
opennextjs-cloudflare buildcommand, but the README notes that "theopennextjs-cloudflarefrom official documentation doesn't work." Please verify:
- Does the
opennextjs-cloudflareCLI work correctly in your setup?- Are these scripts tested and functional?
If the CLI doesn't work, consider updating the scripts to use alternative commands as suggested in the README.
| "next": "^15.2.4", | ||
| "next-transpile-modules": "^10.0.1", | ||
| "node-telegram-bot-api": "^0.66.0", | ||
| "npx": "^10.2.2", |
There was a problem hiding this comment.
Remove unnecessary npx dependency.
The npx package is unnecessary as npx is a CLI tool bundled with npm (version 5.2.0+). Adding it as a dependency can cause conflicts and is not a standard practice.
Apply this diff:
"node-telegram-bot-api": "^0.66.0",
- "npx": "^10.2.2",
"passport": "^0.7.0",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "npx": "^10.2.2", | |
| "node-telegram-bot-api": "^0.66.0", | |
| "passport": "^0.7.0", |
🤖 Prompt for AI Agents
In package.json around line 82, remove the "npx": "^10.2.2" entry from
dependencies (or devDependencies) because npx is bundled with npm and should not
be installed as a package; delete that line, run npm install (or yarn install)
to update package-lock.json/yarn.lock, and verify existing npm scripts still
work without the explicit npx dependency.
| For CloudFlare deployment, wrangler.toml is the configuration file. | ||
|
|
||
| 1. You must login using wrangler before running the `wrangler` CLI (`wrangler login`) | ||
| 2. Run the commands via `wrangler`, (` wrangler build`, `wrangler dev`) since the `opennextjs-cloudflare` from official documentation doesn't work |
There was a problem hiding this comment.
Fix code span formatting.
Extra spaces inside the backticks break markdown formatting.
Apply this diff:
-2. Run the commands via `wrangler`, (` wrangler build`, `wrangler dev`) since the `opennextjs-cloudflare` from official documentation doesn't work
+2. Run the commands via `wrangler` (`wrangler build`, `wrangler dev`) since the `opennextjs-cloudflare` from official documentation doesn't work📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| 2. Run the commands via `wrangler`, (` wrangler build`, `wrangler dev`) since the `opennextjs-cloudflare` from official documentation doesn't work | |
| 2. Run the commands via `wrangler` (`wrangler build`, `wrangler dev`) since the `opennextjs-cloudflare` from official documentation doesn't work |
🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
78-78: Spaces inside code span elements
(MD038, no-space-in-code)
🤖 Prompt for AI Agents
In README.md around line 78, the code spans contain extra spaces (e.g. "(`
wrangler build`, `wrangler dev`") which breaks Markdown formatting; remove the
stray space after the opening backticks so each command is a proper code span
(e.g. "`wrangler build`, `wrangler dev`"), and ensure other inline code uses
backticks without surrounding spaces.
1 participant
Summary by CodeRabbit
New Features
Documentation
Chores