r/npm

GHSA-vcvr-r3jv-pc5j (next/og ImageResponse RCE, 16.2.0 to <16.3.6) landed on Sep 30, on top of the two image optimizer RCEs from Sep 8 (fixed in 15.5.24 and 16.3.3). We run 81 web apps on one box, so we had agents read every repo's lockfile, then bump next, eslint-config-next and @next/* only, build, boot the app the way prod runs it, compare pages and image routes against live, merge and deploy. 30 apps went to 16.3.8 and 4 stayed on 15 and went to 15.5.27.

Things that actually came up:

• 16.3's build-time type check fails with TS5097 on test files that import a .ts path. 16.2 never flagged it. "allowImportingTsExtensions": true fixes it if you already have noEmit.
• sharp moves from 0.34 to 0.35 with the upgrade. In standalone output, check that @img/sharp-libvips-/lib/libvips-cpp.so. is actually in your image. On one app yesterday it was not traced, and every OG image returned 500 with ERR_DLOPEN_FAILED. outputFileTracingIncludes fixes it.
• next-env.d.ts gains an import for .next/types/root-params.d.ts. Commit it, Next regenerates it on every build anyway.
• The default 404 page now shows your site title instead of "404: This page could not be found". Status is still 404.
• eslint-config-next 16 broke one flat config and added two React hooks rules (set-state-in-effect, immutability) that flagged existing components. We set those to warn for the patch.
• A plain re-install can move unrelated packages in the lockfile (bun dropped and re-hoisted a few). Diff the lockfile and keep only next and its own deps, so a security patch stays a security patch.

No runtime breakage in any of the 34. Longer write-up on why speed of knowing is the advantage now: https://dev.profullstack.com/~anthony/blog/208-post.html

I maintain multiple legacy React apps - CRA, React 18, client-side routing, content from a CMS / Wordpress REST API. But SEO and OG tags need real HTML, and a client-side app hands them an empty page.

react-snap solved that for years. It has been unmaintained since 2019 and breaks a little more with every browser update. I could not find a drop in replacement so I built one. It has been running on my own site for a while, and now I am putting it out there: snappy-prerender.

What it does, in one sentence: it opens every page of your built app in a real browser at build time and saves the result as plain HTML, so crawlers see the page your users see.

npm
 install --save-dev snappy-prerender@next
npx snappy-prerender init      # a few questions, then a config file
npx snappy-prerender build     # or run it from vite build

No server, no rewrite, no changes to how the app works.

Things I added because I needed them

• It checks every page after the build and tells you whether the app's JavaScript picked up the prerendered HTML or threw it away and redrew everything. That report is the part I use most.
• It writes the page title, description, canonical link and Open Graph/Twitter tags for each route, including when the user navigates around the site, so you do not need react-helmet for that.
• It handles the fiddly things that usually break prerendering: styles injected by CSS-in-JS, form state, data fetched from an API, critical CSS, preload hints.
• It works with a strict Content Security Policy if your project needs one.

What it is not

• Not server-side rendering. It runs at build time, so new content means a new build.
• Not for Next.js, Remix or Astro users; those already render HTML on the server.
• It cannot fix an app that renders differently every time (dates, random values, viewport-dependent layout). It does tell you which page has the problem.
• It is a release candidate: 2.6.0-rc.2 is on npm under the next tag while I gather feedback.

Links

• npm: https://www.npmjs.com/package/snappy-prerender (install with u/next until 2.6.0 is stable)
• GitHub: https://github.com/sayakmukherjee080/snappy-prerender
• MIT licensed. Issues and PRs welcome, especially if you have an old SPA that breaks it. The README covers every option.

Looking forward to criticism, bug-reports and feature-requests and revival requests for unmaintained plugins (react and family only)