From e304ccf68e3a239131ddedcfe81adfadbdad8003 Mon Sep 17 00:00:00 2001 From: Will Manning Date: Thu, 29 Oct 2026 21:01:51 -0400 Subject: [PATCH] fix: make MDXRenderer a build error outside server components MDXRenderer evaluates velite's compiled MDX with `new Function`. The CSP has no 'unsafe-eval', which is correct only while the eval runs on the server, but nothing enforced that. Import "server-only", which Next.js resolves itself, so importing MDXRenderer from a Client Component fails the build instead of failing at runtime in the browser. Verified: the build passes as is, and a temporary client component that imports MDXRenderer fails the Turbopack build. Fixes #70. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Will Manning --- src/components/MDXRenderer.tsx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/components/MDXRenderer.tsx b/src/components/MDXRenderer.tsx index 2ee97f1..f15d90b 100644 --- a/src/components/MDXRenderer.tsx +++ b/src/components/MDXRenderer.tsx @@ -1,3 +1,7 @@ +// compileMDXComponent evaluates code with `new Function`. The CSP has no +// 'unsafe-eval', which is safe only while this runs on the server, so make +// importing it from a Client Component a build error. +import "server-only"; import * as runtime from "react/jsx-runtime"; interface MDXRendererProps {