From 4bbaf5558687cc29e0f1b8475eb312606788ed71 Mon Sep 17 00:00:00 2001 From: Kfir Amar Date: Sun, 15 Mar 2026 01:17:04 +0200 Subject: [PATCH 1/3] fix(dev): allow localhost HMR origins Add localhost and 127.0.0.1 to allowedDevOrigins so local dev sessions opened on loopback addresses do not have their Next.js HMR websocket blocked as cross-origin. --- next.config.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/next.config.mjs b/next.config.mjs index f066f1c8ad..ac673e5148 100644 --- a/next.config.mjs +++ b/next.config.mjs @@ -8,7 +8,7 @@ const nextConfig = { output: "standalone", serverExternalPackages: ["better-sqlite3", "zod"], transpilePackages: ["@omniroute/open-sse"], - allowedDevOrigins: ["192.168.*"], + allowedDevOrigins: ["localhost", "127.0.0.1", "192.168.*"], typescript: { // TODO: Re-enable after fixing all sub-component useTranslations scope issues ignoreBuildErrors: true, From 783d7ae60564c3eb26e1cf1e63018fbee580ae24 Mon Sep 17 00:00:00 2001 From: Kfir Amar Date: Sun, 15 Mar 2026 01:51:59 +0200 Subject: [PATCH 2/3] test(dev): cover loopback dev origins Add a focused config regression test that locks in localhost, 127.0.0.1, and the existing LAN dev origin allowlist. --- tests/unit/dev-origins-config.test.mjs | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 tests/unit/dev-origins-config.test.mjs diff --git a/tests/unit/dev-origins-config.test.mjs b/tests/unit/dev-origins-config.test.mjs new file mode 100644 index 0000000000..8b2708955e --- /dev/null +++ b/tests/unit/dev-origins-config.test.mjs @@ -0,0 +1,11 @@ +import test from "node:test"; +import assert from "node:assert/strict"; + +test("next config allows loopback dev origins alongside LAN access", async () => { + const { default: nextConfig } = await import("../../next.config.mjs"); + + assert.equal(Array.isArray(nextConfig.allowedDevOrigins), true); + assert.equal(nextConfig.allowedDevOrigins.includes("localhost"), true); + assert.equal(nextConfig.allowedDevOrigins.includes("127.0.0.1"), true); + assert.equal(nextConfig.allowedDevOrigins.includes("192.168.*"), true); +}); From 8ebe1cc2d8c3c0547a2653d0ced6d2dccfe8f8ad Mon Sep 17 00:00:00 2001 From: Kfir Amar Date: Sun, 15 Mar 2026 02:06:49 +0200 Subject: [PATCH 3/3] test(config): tighten dev origins assertion --- tests/unit/dev-origins-config.test.mjs | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/tests/unit/dev-origins-config.test.mjs b/tests/unit/dev-origins-config.test.mjs index 8b2708955e..e852791e74 100644 --- a/tests/unit/dev-origins-config.test.mjs +++ b/tests/unit/dev-origins-config.test.mjs @@ -4,8 +4,5 @@ import assert from "node:assert/strict"; test("next config allows loopback dev origins alongside LAN access", async () => { const { default: nextConfig } = await import("../../next.config.mjs"); - assert.equal(Array.isArray(nextConfig.allowedDevOrigins), true); - assert.equal(nextConfig.allowedDevOrigins.includes("localhost"), true); - assert.equal(nextConfig.allowedDevOrigins.includes("127.0.0.1"), true); - assert.equal(nextConfig.allowedDevOrigins.includes("192.168.*"), true); + assert.deepEqual(nextConfig.allowedDevOrigins, ["localhost", "127.0.0.1", "192.168.*"]); });