fix: allow importing the bundle without a DOM

[theluckystrike]

Fixes #149

What

require('@microlink/react-json-view') throws ReferenceError: document is not defined in Node. So the package breaks during SSR, for example in Next.js.

Why

dist/main.js is built with webpack for the web target. For react-textarea-autosize, webpack picks its browser build. That build runs this line when the module loads:

var isIE = !!document.documentElement.currentStyle

The package also ships a default build that checks typeof document !== 'undefined' first. That one works in both Node and the browser.

How

One alias in webpack/webpack.config.js points react-textarea-autosize at its default build. Nothing in src changes. In the browser it behaves the same. The minified bundle grows from 110501 to 112002 bytes.

Tests

New test test/tests/js/Bundle-test.js builds the bundle with the real webpack config. Then it runs it in a fresh vm context with no window or document.

Before the fix:

0 passing
1 failing
ReferenceError: document is not defined

After the fix the full suite passes, 204 tests. I also checked the built dist/main.js by hand on Node 25:

• require('./dist/main.js') works
• renderToString of <ReactJsonView src={{ a: 1 }} /> returns HTML
• import('./index.mjs') works
• rendering into a jsdom page still works

standard reports no new findings on the changed files.

Summary by CodeRabbit

• Bug Fixes
  • Improved server-side rendering compatibility by preventing browser-only code from running during package imports.
• Tests
  • Added a check that the bundled package can be loaded without browser globals.

[vercel]

@theluckystrike is attempting to deploy a commit to the Microlink Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e28bc6a3-5918-4597-9459-7cc53983f6c3

📥 Commits

Reviewing files that changed from the base of the PR and between 1dcdcfe and 07a8970.

📒 Files selected for processing (2)

• test/tests/js/Bundle-test.js
• webpack/webpack.config.js

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

Webpack now resolves react-textarea-autosize through its default entry. A bundle test builds the output and checks that its default export is a function when evaluated without window or document.

Changes

SSR bundle import

Layer / File(s)	Summary
Dependency resolution and bundle validation webpack/webpack.config.js, test/tests/js/Bundle-test.js	Webpack aliases react-textarea-autosize to its default entry. The test builds the bundle without minification, evaluates it in a VM context without DOM globals, checks that the default export is a function, and removes temporary output.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 07a89

The change lets the bundle be imported without a DOM by using the default build of react-textarea-autosize. No actionable merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 07a89

The change is narrowly scoped to server-compatible bundle loading. No new privileged capability or boundary bypass was identified. Verification remains limited because the exact dependency entry and generated bundle were unavailable.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected scope is consumers of the generated package bundle, including applications importing it during server rendering. Successful DOM-free loading is a compatibility expansion, not evidence of a new remotely accessible endpoint.

Trust Boundaries and Controls

• inferred — The observed alias is fixed by build configuration rather than consumer input, and the VM executes locally generated test output. These paths do not establish an attacker-controlled module selector or additional runtime authority. This conclusion is bounded to the inspected configuration and test, not the unavailable dependency implementation.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: enabling bundle imports without a DOM.
Linked Issues check	✅ Passed	Issue #149 requires the package to import without browser globals during server-side evaluation. The webpack alias in webpack/webpack.config.js selects the dependency build that checks for `document…
Out of Scope Changes check	✅ Passed	The webpack alias and bundle test both address issue #149 by preventing and checking DOM access during bundle evaluation. The reported changes show no unrelated modifications.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
react-json-view	Ready	Preview	Oct 3, 2026 8:43am UTC

[Kikobeats]

Awesome, thanks!

[theluckystrike]

@Kikobeats, thanks for merging both. Since #210 changed how the bundle loads, #146 looks like the right next one, where the default import comes back as a module object under Vite 8 and you'd asked for a PR. I'll check what #142 changed in package.json first. Then I'll send the smallest fix a test can prove.

Thank you,
Michael Lip
Founder of https://zovo.one, 108 Chrome extensions with 150,000+ users
Also building https://makeroll.com and https://ml0x.com, open-source guardrails for Claude Code agents
Open source has to win, and small fixes like this one are my part of it

[theluckystrike]

@Kikobeats, thanks for merging #210. Requiring the package in Node no longer throws "document is not defined", so Next.js and other SSR setups can import it, and that closed #149. It's my third merged change here, after #102 back in March and #211 the same morning. More of what I work on is at https://github.com/theluckystrike. Even a small one-time sponsorship at https://github.com/sponsors/theluckystrike would tell me the time on these fixes was appreciated, and I'd gladly keep sending more to react-json-view. Totally fine if not. Thank you, Michael Lip Founder of https://zovo.one, 108 Chrome extensions with 150,000+ users Also building https://makeroll.com and https://ml0x.com, open-source guardrails for Claude Code agents Open source has to win, and small fixes like this one are my part of it