You removed the examples related with Remote MDX, okey, it is hard to maintain, but why did you remove info about Remote MDX in ‎docs/01-app/02-guides/mdx.mdx‎. It was useful. We would rather get it back.

As part of the CVE's disclosed, we decided to temporarily take back the recommendation. It is still available in our v15 docs.

The path forward for now is to reintroduce a note about Remote MDX, showing patterns secure by default, even if it introduces friction for developers.

Thank you for your answer. The "Remote MDX" section previously featured the community-driven next-mdx-remote-client package. To proactively address and minimize the impact of the disclosed CVEs, a specialized utility called remark-mdx-remove-expressions has been developed.

This plugin is specifically designed to be integrated into workflows like next-mdx-remote-client to strip potentially malicious logic from remote content. There is an active discussion regarding this security strategy in next-mdx-remote-client/issues/18.

The recommendation for scenarios where the developer does not have full control over the remote MDX source is to utilize remark-mdx-remove-expressions with the { onlyDangerousExpressions: true } option. This provides a "secure by default" layer by neutralizing executable code while preserving the descriptive power of MDX.

I would highly appreciate it if you could review the insights shared in this issue, as it might provide the secure pattern needed to reintroduce the Remote MDX documentation without compromising user safety.

Great. Yes I did find that issue last week. I can't plan the content right now, but I imagine it'll be something like

• how's mdx actually transformed to other content types
• mdx from disk
• plugin layer, what do these do
• mdx from a remote source
  • a safe set of plugin defaults

Basically, rework Deep Dive: How do you transform markdown into HTML?

I'll likely comment back on the issue when I get to it. PRs/drafts are always welcome too.