chore: update vite-rsc example
#3922
Conversation
📝 WalkthroughWalkthroughRe-enables a previously commented-out RSC link in the example app's root component and updates its reference target. Pins devDependencies in package.json to specific semver ranges: Vite React plugin to ^5.1.2 and Vite RSC plugin to ^0.5.11. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@hi-ogawa is attempting to deploy a commit to the Nitro Team on Vercel. A member of the Team first needs to authorize it. |
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI Agents
In @examples/vite-rsc/app/root.tsx:
- Line 62: The anchor element with href="./_.rsc" uses target="_blank" but lacks
rel="noopener noreferrer"; update that <a href="./_.rsc" target="_blank">
element to include rel="noopener noreferrer" to prevent
window.opener/tabnabbing, and apply the same change to the other external anchor
that uses target="_blank" (the ?__nojs link) for consistency.
- Around line 60-66: Anchor elements that open new tabs (e.g., the <a
href="./_.rsc" target="_blank"> link in root.tsx and the other <a
target="_blank"> instance) are missing rel="noopener noreferrer"; update both
anchor tags to include rel="noopener noreferrer" so the opened pages cannot
access window.opener, keeping the existing href and target attributes unchanged.
In @examples/vite-rsc/package.json:
- Around line 19-20: The package version for "@vitejs/plugin-rsc" is set to an
unpublished release (^0.5.11); update the dependency entry for
"@vitejs/plugin-rsc" in package.json to a published version (for example
"^0.5.8" or "^0.5.1") so installations succeed and remain compatible with
"@vitejs/plugin-react".
🧹 Nitpick comments (1)
examples/vite-rsc/package.json (1)
19-23: Consider adopting a consistent versioning strategy.Lines 19-20 now use specific semver ranges while lines 21 and 23 continue using "latest" and "beta". For better reproducibility in examples, consider pinning all devDependencies to specific versions or document why certain packages use dynamic versions.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
examples/vite-rsc/app/root.tsxexamples/vite-rsc/package.json
🧰 Additional context used
🧠 Learnings (3)
📚 Learning: 2025-12-24T11:45:17.435Z
Learnt from: CR
Repo: nitrojs/nitro PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-24T11:45:17.435Z
Learning: Avoid introducing new dependencies unless strictly necessary; add to `devDependencies` unless required in runtime logic
Applied to files:
examples/vite-rsc/package.json
📚 Learning: 2025-12-24T11:45:17.435Z
Learnt from: CR
Repo: nitrojs/nitro PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-24T11:45:17.435Z
Learning: Update types and JSDoc for API changes
Applied to files:
examples/vite-rsc/package.json
📚 Learning: 2025-12-24T11:45:17.435Z
Learnt from: CR
Repo: nitrojs/nitro PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-24T11:45:17.435Z
Learning: Applies to src/**/*.{ts,js,tsx,jsx} : Use ESM and modern JavaScript
Applied to files:
examples/vite-rsc/app/root.tsx
🪛 Biome (2.1.2)
examples/vite-rsc/app/root.tsx
[error] 62-62: Avoid using target="_blank" without rel="noopener" or rel="noreferrer".
Opening external links in new tabs without rel="noopener" is a security risk. See the explanation for more details.
Safe fix: Add the rel="noopener" attribute.
(lint/security/noBlankTarget)
| "@vitejs/plugin-react": "^5.1.2", | ||
| "@vitejs/plugin-rsc": "^0.5.11", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
@vitejs/plugin-react 5.1.2 npm
💡 Result:
Yes — @vitejs/plugin-react version 5.1.2 is published. Install with:
npm install -D @vitejs/[email protected]. [1][2]
Changelog notes (selection): v5.1.1 updated support for newer rolldown-vite (optimizeDeps.rolldownOptions); v5.1.2 is listed in the plugin releases. [2][3]
Sources:
- Package listing (jsDelivr showing v5.1.2). [1]
- @vitejs/plugin-react release notes / changelog entries. [2]
- Package summary/docs (npm listing). [3]
🌐 Web query:
@vitejs/plugin-rsc 0.5.11 npm
💡 Result:
I couldn't find a published npm version 0.5.11 of @vitejs/plugin-rsc. The npm listing and package indexes show versions in the 0.4–0.5.x range (examples: npm listing / latest shown as 0.4.29 in the npm page snapshot [1]; aggregator shows latest 0.5.1 [2]), and security advisories reference fixes in 0.5.3–0.5.8 but not 0.5.11 [3][4]. If you want, I can check the npm registry or the GitHub repo now to confirm the absolute latest published version.
Sources:
[1] npm package page snapshot for @vitejs/plugin-rsc.
[2] Package aggregator (reactlibraries) showing latest 0.5.1.
[3] GitHub security advisory for vite-plugin-react (mentions patched versions).
[4] OSV/other advisories referencing fixed versions.
🏁 Script executed:
cat examples/vite-rsc/package.json | head -30Repository: nitrojs/nitro
Length of output: 605
Update @vitejs/plugin-rsc to an available version.
@vitejs/plugin-react@^5.1.2 exists and is compatible. However, @vitejs/plugin-rsc@^0.5.11 is not published on npm. The latest available versions are 0.5.1 or up to 0.5.8 based on release history. Update to an available version to prevent installation failures.
🤖 Prompt for AI Agents
In @examples/vite-rsc/package.json around lines 19-20, The package version for
"@vitejs/plugin-rsc" is set to an unpublished release (^0.5.11); update the
dependency entry for "@vitejs/plugin-rsc" in package.json to a published version
(for example "^0.5.8" or "^0.5.1") so installations succeed and remain
compatible with "@vitejs/plugin-react".
2 participants
🔗 Linked issue
Follow up to #3919
This PR replaces pkg.pr.new with proper release package.
❓ Type of change
📚 Description
📝 Checklist