Skip to content

fix(runtime): avoid server-side script use callbacks - #820

Merged
harlan-zw merged 1 commit into
mainfrom
fix/server-safe-script-use
Jun 30, 2026
Merged

fix(runtime): avoid server-side script use callbacks#820
harlan-zw merged 1 commit into
mainfrom
fix/server-safe-script-use

Conversation

@harlan-zw

Copy link
Copy Markdown
Collaborator

🔗 Linked issue

Related to #815

❓ Type of change

  • 📖 Documentation
  • 🐞 Bug fix
  • 👌 Enhancement
  • ✨ New feature
  • 🧹 Chore
  • ⚠️ Breaking change

📚 Description

scriptOptions.use() can read browser globals while Unhead builds script proxies. In SSR builds, window can be rewritten to undefined, so touching a registry proxy during server render can throw before hydration.

This wraps use() with a server-side noop in useScript and useRegistryScript, including npm-mode scripts. The client path still gets the original callback.

@vercel

vercel Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
scripts-playground Ready Ready Preview, Comment Jun 30, 2026 12:18pm

@pkg-pr-new

pkg-pr-new Bot commented Jun 30, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts@820

commit: acab727

@coderabbitai

coderabbitai Bot commented Jun 30, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

resolveClientUse is added to packages/script/src/runtime/utils.ts. It returns undefined for the use option when not running on the client, otherwise returns use unchanged. This helper is applied in useRegistryScript for both the scriptMode: 'npm' path (passed to createNpmScriptStub) and the standard scriptOptions.use path. Additionally, useScript in composables/useScript.ts gains a direct server-only guard that replaces options.use with a stub returning undefined. Two unit tests are added covering both scenarios.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main runtime fix: preventing server-side script use callbacks.
Description check ✅ Passed The description matches the changeset and explains the SSR no-op wrapping for use callbacks, including npm-mode scripts.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/server-safe-script-use

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/unit/utils.test.ts (1)

26-55: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a direct SSR test for useScript().

Because this file mocks packages/script/src/runtime/composables/useScript, the new guard at Line 165 in packages/script/src/runtime/composables/useScript.ts never runs here. A regression in the direct useScript() path would still pass this suite. Consider adding one spec that calls the real composable without that mock.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/unit/utils.test.ts` around lines 26 - 55, Add a direct SSR regression
test for useScript() itself, since the current specs only exercise
useRegistryScript and the mock for
packages/script/src/runtime/composables/useScript bypasses the new server-side
guard. Create one test that imports/calls the real useScript composable without
that mock, runs it in an SSR-like context, and asserts the returned use handler
is server-safe while any unsafe use callback is not invoked.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/unit/utils.test.ts`:
- Around line 26-55: Add a direct SSR regression test for useScript() itself,
since the current specs only exercise useRegistryScript and the mock for
packages/script/src/runtime/composables/useScript bypasses the new server-side
guard. Create one test that imports/calls the real useScript composable without
that mock, runs it in an SSR-like context, and asserts the returned use handler
is server-safe while any unsafe use callback is not invoked.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 593a9df7-09df-4a67-aead-29ec54660729

📥 Commits

Reviewing files that changed from the base of the PR and between 566e469 and acab727.

📒 Files selected for processing (3)
  • packages/script/src/runtime/composables/useScript.ts
  • packages/script/src/runtime/utils.ts
  • test/unit/utils.test.ts

@harlan-zw
harlan-zw merged commit a28962e into main Jun 30, 2026
22 of 23 checks passed
@harlan-zw
harlan-zw deleted the fix/server-safe-script-use branch June 30, 2026 13:02
@harlan-zw
harlan-zw restored the fix/server-safe-script-use branch August 14, 2026 03:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant