- Shipped
- August 20, 2026 at 9:34 PM UTC
- Author
- Kamo
- Commit
- 977c49a
The flagged chunk is react-dom, and I checked it properly before concluding anything: it is the production build (no dev markers, and the profiling hooks `injectProfilingHooks` and `markComponentRenderStarted` are both absent — the lone `unstable_Profiling` hit is an export name), it is 19.2.3 deduped with exactly ONE copy across all chunks, and `reactProductionProfiling` is off. There is no bloat bug to fix, and a framework will always ship code a given page does not execute, so the audit itself cannot be cleared. What could be fixed is how it is delivered. `/_next/static/*` was going out as gzip while every modern client asked for brotli: react-dom chunk gzip 69,632 -> brotli 56,967 (-18%) all JS + CSS gzip 675.8 KB -> brotli 576.6 KB (-99.2 KB) Brotli at quality 11 is exactly the setting that cost 565 ms per request on the HTML document, and it is free here for the opposite reason: these files are content-hashed and served `immutable`, so a given URL can never change its bytes. Compressing them once at build time costs a few build seconds and nothing at all per request. The document keeps quality 5 because it carries a per-request nonce and has to be compressed live — the two cases genuinely want different answers. The wrapper serves the prebuilt `.br` sibling when one exists and the client accepts br, and returns false for anything it is not certain about, so a miss costs a stat() and falls through to Next untouched. Verified rather than assumed, since this touches file serving: · brotli served when accepted, with the immutable header preserved · a gzip-only client still gets a working 200 through Next · a missing .br 404s normally · encoded traversal — `%2e%2e` at .js paths pointing to server.js and server-nonce.js, which really do exist outside the static root — is rejected with no source leaked. Plain `../` is not a valid test: curl normalises it before the request is sent.