[Next.js] Exclude ComponentProps functions from the client bundle

[illiakovalenko]

• This PR follows the Contribution Guide
• Changelog updated

Description / Motivation

This pull request aims to enhance the security of the app by excluding getStaticProps and getServerSideProps (component level data fetching functions) from the client bundle. This change ensures that secret values are not exposed to the client side.

Please note that in development mode, these values are exposed regardless. This is a known behavior and is not considered a security issue.

Resolves #1615

Testing Details

• Unit Test Added
• Manual Test/Other - added getStaticProps/getServerSideProps to existing components and imported a secret variable. Secret variable is not included in a bundle (in production mode)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

[ambrauer]

I like it!

[coreyasmith]

Great work and thank you!!! 🎉

[matthewgisonno]

@illiakovalenko, thanks for your work on this! The loader works well, but there are a couple of issues with the test pattern in componentPropsPlugin:

• It's tailored for Windows paths, causing issues on other systems.
• It only matches .tsx files, limiting file type flexibility.

I recommend updating the pattern to:

test: /src[\\\/]components[\\\/].*\.(js|jsx|ts|tsx)$/,

This should ensure compatibility across all systems and with various file types.

[illiakovalenko]

@matthewgisonno Good point
I will add it as a follow-up for us. It's possible to make it more flexible. Currently, it's tied to the existing next.js starter (typescript based)