Okta's NextJS-0auth troubles

NextJS Security Vulnerability

NextJS 16 broke our production

Umami affected by NextJS CVE-2025-66478

Zero configuration NextJS deployment to a self hosted VPS with Kamal

See also: <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;react2shell-rsc-vulnerabilities-exploitation-threat-brief&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;react2shell-rsc-vulnerabilities-...</a>, <a href="https:&#x2F;&#x2F;nextjs.org&#x2F;blog&#x2F;security-update-2025-12-11" rel="nofollow">https:&#x2F;&#x2F;nextjs.org&#x2F;blog&#x2F;security-update-2025-12-11</a>

Denial of service and source code exposure in React Server Components

I built Cossistant as a lightweight, open-source alternative to Intercom&#x2F;Zendesk for NextJS&#x2F;React devs. You can embed it with a simple NPM command and under 10 lines of code.The goal was so far to be a very very good human to human support platform, the next goal is to enable AI agents to auto-handle 80% of queries (train on your docs and knowledge) and eventually escalate to humans when needed.Everything is customizable with Tailwind or your custom React components.Support tools are bloated, pricey and never FEEL &#x2F; LOOK like your product, this is why it&#x27;s being shipped as part of your stack and not coming from someone else&#x27;s.It&#x27;s already generally available!Feedback&#x2F;debates are welcome, what&#x27;s missing?

Show HN: Cossistant – open-source and open components support widget for React

we built sleek.design: you describe your app idea and it generates mobile mockups designs. it is possible to export them into html, react or figma.
it is also possible to get a prompt that can be pasted into bolt and will generate the actual app starting from the design created.this is our third huge pivot and honestly the last shot we&#x27;re giving ourselves.quick backstory: we&#x27;re 3 bootstrapped builders.
launched about a year ago with what&#x27;s now on v1.reweb.so, basically a visual builder for nextjs&#x2F;tailwind&#x2F;shadcn.
it went pretty viral and started growing, but we couldn&#x27;t get past $2k MRR.
everyone kept asking for &quot;sync with codebase&quot; but we&#x27;d built it json-first instead of code-first, so the source of truth wasn&#x27;t the code itself but an internal json representation.
this made sync basically impossible to build.
everyone kept churning and we concluded it was probably better to move on.next was landing.new: AI-generated landing pages from a description.
we made a templating engine where AI would pick and mix premade blocks.
launched it, got maybe 5 sales for less than $400.
then sonnet 3.7 came out and could just build entire landing pages from a prompt, which made our whole templating engine feel worthless.
we basically got demotivated and did no marketing at all.then we went back to reweb (reweb.so), creating an infinite canvas to design components and pages, and iterate quick.
got some customers but AI costs spiked hard and with free trials we earned almost nothing.we now understood that we kept building top-down instead of understanding real user pain first.
we were solving problems we thought existed, and couldn&#x27;t define an ICP even after tons of user interviews.
we are now aware that we kept going mainly because of sunk cost fallacy.
reaching PMF seems increasingly like a mirage, even though we have done everything possible to build the best products we can and maintain consistently high quality.we are running out of savings and, having had virtually no personal income due to low MRR, we have decided to give us two months, if we don&#x27;t start seeing good numbers by the end of the year, we&#x27;ll have to quit this.so now we&#x27;re niching down as much as possible: just mobile app mockups.
got some weak signals in interviews and that&#x27;s it.
we have reduced the free trial to the bare minimum because otherwise the costs of AI would kill us immediately.we have less than $5k left and we&#x27;re going all in on marketing and paying for sponsored content on youtube&#x2F;instagram&#x2F;tiktok.
we are also going to try some SEO, organic content, and so on.i really hope this is the right time.

Show HN: Sleek - AI mobile app mockup generator (our 3rd pivot, last shot)

Last Week, I was tired of hunting through scattered sources to find the best Black Friday deals on premium apps and software so I decided to create a centralized directory myself.Using Claude Code, I vibe coded the entire Black Friday deals directory in just 2 days, and the results have been incredible.Stack:Nextjs for Frontend
Convex for Database
Umami and Posthog for analytics
Dodopayment for PaymentIn less than a week, it’s attracted 4,000+ visitors, with 500+ coming in just the last 24 hours (Analytic is public on website, so you can verify the traffic yourself :))The directory features lifetime deals and product bundles on premium apps and tools, curated specifically for developers, creators, and entrepreneurs looking for genuine value.If you’re hunting for Black Friday deals on premium software, check it out And if I’ve missed any great deals, drop them in the comments.

Show HN: I Curated Premium Black Friday Deals for SaaS and Apps

Hey HN! We built Agent Runner, a model-agnostic, open-source agent harness that executes the same prompt against two anonymized coding agents in parallel sandboxes. Each agent can make tool calls, edit multiple files, and self-correct through iterative reasoning. You pick the better result - this becomes the ground truth for the leaderboard.Why we built it
Traditional benchmarks often fall short for modern agentic systems: they rely on static tasks and only measure final outputs. But real coding agents modify multiple files across a repo, answer to user re-prompts, use tool calls, and recover from partial failuresWhat Agent Runner does
You ask it to build anything
Agent Runner kicks off two generations from different sandboxed LLM providers (OpenAI, Anthropic, Google, xAI, Mistral, Kimi, and more)
Anonymized models make tool calls, multi-file edits, and cater to reprompts
You pick your favorite - this preference powers the benchmarkBecause different providers handle tool calls, prompts, and execution semantics differently, we worked with each provider to ensure configurations reflect intended behavior. These provider-specific setups remain private, but Agent Runner itself is open-source.How to try it
Kick off Agent Runner at <a href="https:&#x2F;&#x2F;www.designarena.ai&#x2F;agentarena">https:&#x2F;&#x2F;www.designarena.ai&#x2F;agentarena</a>
Repo at <a href="https:&#x2F;&#x2F;github.com&#x2F;Design-Arena&#x2F;agent-runner" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Design-Arena&#x2F;agent-runner</a>
Use it as a CLI tool: <a href="https:&#x2F;&#x2F;pypi.org&#x2F;project&#x2F;agent-runner&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pypi.org&#x2F;project&#x2F;agent-runner&#x2F;</a>
pip install agent-runner
agentrunner run “create a nextjs replica of Discord”We hope this provides a provider-agnostic, framework-agnostic, realistic benchmark for state-of-the-art coding agents.Video demo: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;rdtiuCHatjs" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;rdtiuCHatjs</a>

Show HN: Agent Runner – open-source agent harness to benchmark real coding

I finally got around to making a tool I&#x27;ve wanted for a long time: you can basically think of it as being &quot;like Gmail for coding agents.&quot;If you&#x27;ve ever tried to use a bunch of instances of Claude Code or Codex at once across the same project, you&#x27;ve probably noticed how annoying it can be when they freak out about the other agent changing the files they&#x27;re working on.Then they start doing annoying things, like restoring files from git, in the process wiping out another agent&#x27;s work without a backup.Or if you&#x27;ve tried to have agents coordinate on two separate repos, like a Python backend and a Nextjs frontend for the same project, you may have found yourself acting as the go-between and liaison between two or three different agents, passing messages between them or having them communicate by means of markdown files or some other workaround.I always knew there had to be a better way. But it&#x27;s hard to get the big providers to offer something like that in a way that&#x27;s universal, because Anthropic doesn&#x27;t want to integrate with OpenAI&#x27;s competitive coding tool, and neither wants to deal with Cursor or Gemini-CLI.So a few days ago, I started working on it, and it&#x27;s now ready to share with the world. Introducing the 100% open-source MCP Agent Mail tool. This can be set up very quickly and easily on your machine and automatically detects all the most common coding agents and configures everything for you.I also include a ready-made blurb (see the README file in the repo) that you can add to your existing AGENTS dot md or CLAUDE dot md file to help the agents better leverage the system straight out of the gate.It&#x27;s almost comical how quickly the agents take to this system like a fish to water. They seem to relish in it, sending very detailed messages to each other just like humans do, and start coordinating in a natural, powerful way. They even give each other good ideas and pushback on bad ideas.They can also reserve access to certain files to avoid the &quot;too many cooks&quot; problems associated with having too many agents all working on the same project at the same time, all without dealing with git worktrees and &quot;merge hell.&quot;This also introduces a natural and powerful way to do something I&#x27;ve also long wanted, which is to automatically have multiple different frontier models working together in a collaborative, complementary way without me needing to be in the middle coordinating everything like a parent setting up playdates for their kids.And for the human in the loop, I made a really slick web frontend that you can view and see all the messages your agents are sending each other in a nice, Gmail-like interface, so you can monitor the process. You can even send a special message to some or all your agents as the &quot;Human Overseer&quot; to give them a directive (of course, you can also just type that in manually into each coding agent, too.)I made this for myself and know that I&#x27;m going to be getting a ton of usage out of it going forward. It really lets you unleash a massive number of agents using a bunch of different tools&#x2F;models, and they just naturally coordinate and work with each other without stepping on each other&#x27;s toes. It lets you as the human overseer relax a bit more as you no longer have to be the one responsible for coordinating things, and also because the agents watch each other and push back when they see mistakes and errors happening. Obviously, the greater the variety of models and agent tools you use, the more valuable that emergent peer review process will be.Anyway, give it a try and let me know what you think. I&#x27;m sure there are a bunch of bugs that I&#x27;ll have to iron out over the next couple days, but I&#x27;ve already been productively using it today to work on another project and it is pretty amazingly functional already!

Show HN: MCP Agent Mail, Like Gmail for Coding Agents

Two months ago I was laid off due to oil market conditions, so I decided to finally try the path of building my own product.I’m a web developer and worked for industrial companies for the last 15+ years, but always watched from the sidelines how everybody was building beautiful startups&#x2F;SAAS websites.I truly believe that every website today should have an AI chatbot that actually works for the business while they sleep: answer questions, capture leads, and reduce support load. This is something I really feel is useful.It enables businesses to create and train their AI chatbot using their website and documents, then embed it directly on their site. The chatbot captures leads automatically and has a ticketing system. I know this market is tough, but I&#x27;m just trying to capture a small percentage of it, while helping businesses in the process.Tech stack?: Nextjs with Typescript and Tailwind (love and hate it, but that&#x27;s for another day), Supabase for database and auth, AWS.This is the first time I have shipped anything like this solo, so any feedback would be greatly appreciated, and I&#x27;m happy to answer any questions.Thank you again for reading!

Show HN: After being laid off from a corporate job I built my first AI Startup

Hey all!Long time lurker, thought I would contribute back something to the community (at least the meat eaters in the UK). One thing that&#x27;s been a pain for me to get a good understanding of is what the best price is for online butchers based around the UK. I like high quality meat (including some of the bigger cuts for kamado&#x2F;bbq), and I&#x27;m willing to pay a premium however there isn&#x27;t a single resource that would let me get an overview of what&#x27;s available and price movements over time.For my Xmas meat I didn&#x27;t want to start building out a spreadsheet so I built a price tracker with quite a few convenience features to make it easy to search for certain cuts of meat across commonly mentioned butchers on Reddit and other communities.If you find it useful let me know if there are any features that could help to make it even easier to find the cuts of meat that you&#x27;re looking for!Here&#x27;s the tracker: <a href="https:&#x2F;&#x2F;offer-spider.onrender.com" rel="nofollow">https:&#x2F;&#x2F;offer-spider.onrender.com</a>Hosted on Render, built with Nextjs and SQLite. Spidering various custom e-com sites (WooCommerce, Shopify) on a daily basis.My current TODOs:
- Search is currently free-text OR. Add AND to allow focussing down a search, and select from facets&#x2F;categories&#x2F;taxonomy
- Common search terms to pre-fill
- Exposing price over time metrics
- Further consolidation of SKUs to an internal taxonomy
- More butchers
- Expanding to other use cases outside of meat!

Show HN: UK Butchers Meat Price Tracker

Hi HNI have been working on Skedular a platform that helps organizations councils co working spaces and local businesses manage bookings shared spaces and multi location operations in a simple modern wayWhat Skedular does<pre><code> - Manage rooms desks studios sports facilities meeting spaces and any kind of bookable asset
 - Handle multi location multi team scenarios
 - Provide public booking pages for venues
 - Offer a clean dashboard for operators to manage availability payments customers and schedules
 - API first design for easy integration with existing systems
 - Built with modern tooling including Nextjs NET backend PostGIS and Kafka events
</code></pre>
Why I built itMost booking platforms are either too simple or too enterprise heavy Skedular is meant to sit in the middle powerful enough for councils or large organisations but simple enough for a local venue owner to use without training.I am currently onboarding early users and would love feedback from this community especially around UX data modelling and scaling patterns.Links<pre><code> - Public website https:&#x2F;&#x2F;getskedular.com
 - App website https:&#x2F;&#x2F;skedular.app
</code></pre>
Looking for feedbackI would appreciate thoughts on the overall concept any edge cases I might be missing suggestions for UI and UX improvements and pain points you have experienced in managing bookings or shared resourcesThanks for taking a look
Morteza

Show HN: Skedular, a Smart Booking and Workspace Management Platform

First launch of the ABAC stack I&#x27;ve been running in prod:*abac-engine (PDP)*: Zero deps, ~4KB gzipped. 9.37 µs warm checks on 100 policies — 26% faster than CASL (6KB, 11.8 µs), 4x faster than Casbin (89KB, 42 µs). PolicyCache handles Vercel cold starts seamlessly.*@devcraft-ts suite (PAP)*: Minimal admin UI layer — modular React hooks + ShadCN components for policy management&#x2F;visual builder. No bloat, just what you need.One-liner: `npm i abac-engine @devcraft-ts&#x2F;abac-admin-react-ui`Live docs: https:&#x2F;&#x2F;abac-admin-02-nextjs-app-router.vercel.app&#x2F;docs
Core PDP: https:&#x2F;&#x2F;github.com&#x2F;astralstriker&#x2F;abac-engine
PAP suite: https:&#x2F;&#x2F;github.com&#x2F;devcraft-tsThoughts on the perf edge over CASL&#x2F;Casbin? Missing PDP features?

Abac-engine: Lean zero-dep ABAC PDP at 9.37 µs with minimal PAP UI

I got tired of needing to copy my AI coding files and configs across multiple projects...So I created OpenPackage, the open source CLI tool that packs your specs, rules, commands, subagents, skills, plugins, and more, into reusable, composable, and shareable packages.It&#x27;s basically a hybrid of npm, GitHub, and Claude Code Plugins for AI coding files.As an example, here&#x27;s one of my favorite commands to use for code cleanup:
<a href="https:&#x2F;&#x2F;openpackage.dev&#x2F;@awesome&#x2F;f&#x2F;.openpackage&#x2F;commands&#x2F;cleanup.md" rel="nofollow">https:&#x2F;&#x2F;openpackage.dev&#x2F;@awesome&#x2F;f&#x2F;.openpackage&#x2F;commands&#x2F;cle...</a>
And my NextJS project scaffolding package:
<a href="https:&#x2F;&#x2F;openpackage.dev&#x2F;@hyericlee&#x2F;nextjs" rel="nofollow">https:&#x2F;&#x2F;openpackage.dev&#x2F;@hyericlee&#x2F;nextjs</a>Would love to see the packages you all come up with to power your AI coding workflows!P.S. Will be launching a TUI for OpenPackage soon, so drop a star on GitHub and stay tuned.

Show HN: I wrote an open source package manager for AI coding, OpenPackage

Two separate but perfect-together projects from the same dev:1. abac-engine → the zero-dep core (my first love)
 • 9.4 µs warm checks (26 % faster than CASL on real policies)
 • JSONPath policies non-devs can edit
 • PolicyCache → survives Vercel cold starts
 • npm i abac-engine
 • https:&#x2F;&#x2F;github.com&#x2F;astralstriker&#x2F;abac-engine2. @devcraft-ts suite → complete admin UI on top of any ABAC backend
 • @devcraft-ts&#x2F;abac-admin-core → Zod + types
 • @devcraft-ts&#x2F;abac-admin-react → headless hooks
 • @devcraft-ts&#x2F;abac-admin-react-ui → ready-made ShadCN components (18 KB)
 • @devcraft-ts&#x2F;abac-admin-nextjs → full Next.js 15 template
 • npm i @devcraft-ts&#x2F;abac-admin-react-uiOne-liner for the full stack:
npm i abac-engine @devcraft-ts&#x2F;abac-admin-react-uiBenchmark proof: https:&#x2F;&#x2F;i.ibb.co.com&#x2F;5YhM0nL&#x2F;abac-engine-vs-casl-live-benchmark-nov10-2025.png
Org: https:&#x2F;&#x2F;github.com&#x2F;devcraft-tsFeedback&#x2F;roast me please.

Devcraft-ts – full ABAC admin suite in <25 KB and abac-engine 9.4 µs core

I built this to scratch an itch - tracking how some hypothetical portfolios might&#x27;ve played out across market regimes, with realistic simulation and daily pnl tracking.Most tools available tend to ignore tax lot, cash drag, flexible strategy input or regime analysis. So I decided to ship my own in Rust (backend, NextJS UI) and worked on it over the last few months.Having worked in the back office of a hedge fund, I have an understanding of how pnl and performance measures are computed. Honestly, it would&#x27;ve been shorter if I have prioritised better. For now, it supports tactical portfolio (fixed allocation) and planning to support more (flexible strategy and more complicated rules).Key features:
- Regime Awareness
- Head-to-Head Portfolio Comparison
- FIFO tax lot accounting
- ETF and Crypto support
- Automated daily valuationBeta, free for now. Feel free to provide feedback:
1. Do you find this useful?
2. Whats missing in this that would make you use this more?
3. Would you pay for a tool like this?<a href="https:&#x2F;&#x2F;www.amibeatingbenchmark.app" rel="nofollow">https:&#x2F;&#x2F;www.amibeatingbenchmark.app</a>

Show HN: Portfolio Simulation with Regime Awareness

Well, part of the Vercel game is to lock you in to their platform and extract $$$, but as I recall you can spec out headers in NextJS config?.  And possibly on CloudFlare itself via cache rules?

We architected an edge caching layer to eliminate cold starts

A friend of mine is using N8N a lot, but he isn&#x27;t a developer and I think that is the main reason. I think LangChain is the most popular, but there is always a trade off between upstart costs, and the cost of forcing a pre-fab to fit your needs as you grow. I personally have used NextJS&#x27;s AI SDK a a lot since it is very web friendly (nodejs&#x2F;JS) <a href="https:&#x2F;&#x2F;ai-sdk.dev&#x2F;docs&#x2F;introduction" rel="nofollow">https:&#x2F;&#x2F;ai-sdk.dev&#x2F;docs&#x2F;introduction</a>.

Ask HN: What agent frameworks are you using, and how well do they work?

# This is a NextJS
NextJS is a **framework for ReactJS**.

Wait a second ... a "framework" for React? Isn't React itself already a framework for JavaScript?

Well ... first of all, React is a "library" for JavaScript. That seems to be important for some people.

Not for me, but still, there is a valid point: React already is a framework / library for JavaScript. So it's already an extra layer on top of JS.

## Getting Started

Create Next App:

```bash
npx create-next-app
# or
yarn create next-app
```

First, run the development server:

```bash
npm run dev
# or
yarn dev
```

Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.

You can start editing the page by modifying `pages/index.js`. The page auto-updates as you edit the file.

[API routes](https://nextjs.org/docs/api-routes/introduction) can be accessed on [http://localhost:3000/api/hello](http://localhost:3000/api/hello). This endpoint can be edited in `pages/api/hello.js`.

The `pages/api` directory is mapped to `/api/*`. Files in this directory are treated as [API routes](https://nextjs.org/docs/api-routes/introduction) instead of React pages.

## Why would we then need NextJS?

Because NextJS makes building React apps easier - especially React apps that should have server-side rendering (though it does way more than just take care of that).

In this article, we'll dive into the core concepts and features NextJS has to offer:

- File-based Routing
- Built-in Page Pre-rendering
- Rich Data Fetching Capabilities
- Image Optimization
- Much More

## File-based Routing

![Create routes via your file + folder structure](nextjs-file-based-routing.png)

# File-based Routing In Action

![Create routes via your file + folder structure](nextjs-file-based-routing-in-action.png)

## Learn More

To learn more about Next.js, take a look at the following resources:

- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.

You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js/) - your feedback and contributions are welcome!

## Deploy on Vercel

The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.

Check out our [Next.js deployment documentation](https://nextjs.org/docs/deployment) for more details.

... More content comming soon ...

NextJs News

News From: hn.algolia.com