Skip to content

fix(deps): update dependency @clerk/nextjs to v7#266

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/clerk-nextjs-7.x
Open

fix(deps): update dependency @clerk/nextjs to v7#266
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/clerk-nextjs-7.x

Conversation

@renovate

@renovate renovate Bot commented Mar 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@clerk/nextjs (source) 6.39.5 → 7.5.22 age confidence

Release Notes

clerk/javascript (@​clerk/nextjs)

v7.5.22

Patch Changes
  • Remove the redundant https://*.client.protect.clerk.com source from CSP headers generated by clerkMiddleware(). (#​9207) by @​mwickett

v7.5.21

Compare Source

Patch Changes

v7.5.20

Compare Source

Patch Changes

v7.5.19

Compare Source

Patch Changes

v7.5.18

Compare Source

Patch Changes

v7.5.17

Compare Source

Patch Changes

v7.5.16

Compare Source

Patch Changes

v7.5.15

Compare Source

Patch Changes

v7.5.14

Compare Source

Patch Changes

v7.5.13

Compare Source

Patch Changes

  • createPathMatcher() and createRouteMatcher() route suggestions now use the :path* subtree form (e.g. /dashboard/:path*) instead of (.*). Unlike /dashboard(.*), which also matches sibling routes such as /dashboardxyz, /dashboard/:path* matches only /dashboard and its path-segment subtree. The new suggestion type is exported as WithPathSegmentWildcard; the existing WithPathPatternWildcard type is unchanged (now deprecated), and (.*) patterns keep working. This only changes the type-level autocomplete suggestion. (#​9057) by @​jacekradko

  • Updated dependencies [1efc7e5, 5028b54, 2e1fec7]:

v7.5.12

Compare Source

Patch Changes

v7.5.11

Patch Changes

v7.5.10

Patch Changes

v7.5.9

Compare Source

Patch Changes

v7.5.8

Compare Source

Patch Changes

v7.5.7

Compare Source

Patch Changes

v7.5.6

Compare Source

Patch Changes

v7.5.5

Patch Changes

v7.5.4

Patch Changes

v7.5.3

Compare Source

Patch Changes

v7.5.2

Compare Source

Patch Changes

v7.5.1

Compare Source

Patch Changes

v7.5.0

Compare Source

Minor Changes

  • Remove the <ConfigureSSO /> component from the public API in favor of usage within OrganizationProfile (#​8779) by @​LauraBeatris

    Removing these exports has no breaking changes impact on production applications, as was never released as a GA component

Patch Changes

v7.4.3

Compare Source

Patch Changes

v7.4.2

Compare Source

Patch Changes

v7.4.1

Compare Source

Patch Changes

v7.4.0

Compare Source

Minor Changes
Patch Changes

v7.3.7

Patch Changes

v7.3.6

Patch Changes

v7.3.5

Compare Source

Patch Changes

v7.3.4

Compare Source

Patch Changes

v7.3.3

Compare Source

Patch Changes

v7.3.2

Compare Source

Patch Changes

v7.3.1

Compare Source

Patch Changes

v7.3.0

Compare Source

Minor Changes

  • Expose OAuthConsent as a public component export across React-based SDKs. (#​8381) by @​wobsoriano

    Example:

    import { OAuthConsent } from '@&#8203;clerk/react';

export default function Page() {
  return <OAuthConsent />;
}
Patch Changes

v7.2.9

Compare Source

Patch Changes

v7.2.8

Compare Source

Patch Changes

  • Use a constant-time comparison when validating the integrity signature on the middleware-to-origin auth header handoff (assertTokenSignature). The previous !== compare was timing-variable; the new helper is synchronous and runtime-agnostic so it works in both Node and Edge Runtime. (#​8411) by @​jacekradko

  • Auto-proxy FAPI requests for .vercel.app subdomains. When deployed to a .vercel.app domain without explicit proxy or domain configuration, the SDK automatically routes Frontend API requests through /__clerk on the app's own origin. This enables Clerk production mode on Vercel deployments without manual proxy setup. (#​8035) by @​brkalow

  • Updated dependencies [9b57986, a9f9b29, e0a63f9]:

v7.2.7

Compare Source

Patch Changes

v7.2.6

Patch Changes

v7.2.5

Patch Changes

  • Refactor clerkMiddleware internals to factor the post-authentication pipeline (handler invocation, CSP, redirects, response decoration) into a private runHandlerWithRequestState helper. Pure refactor — no behavioral change. (#​8368) by @​jacekradko

  • Updated dependencies [93855c2]:

v7.2.4

Patch Changes

  • Add helpful TypeScript error for incorrect auth import path (#​8358) by @​jacekradko

  • Fix an authorization bypass in has(), auth.protect(), and related predicates when a single call combined conditions from more than one dimension (for example, { permission, reverification } or { feature, permission }). A dimension that should have denied the request was treated as indeterminate and ignored by the combining logic, allowing other passing dimensions to carry the result and authorize the call when it should have failed closed. (#​8372) by @​nikosdouvlis

    Behavior is now:

    • When a requested dimension cannot be satisfied because the underlying session data is missing, malformed, or invalid, the call denies. Previously these cases were treated as indeterminate and ignored, which could let another passing dimension carry the call.
    • Fixed a minor bug where session.checkAuthorization() was building authorization options from the membership row id instead of the organization id.

    Single-condition role, permission, feature, and plan checks (has({ permission }), etc.) are unchanged. Single-condition reverification checks are unchanged on well-formed session data; calls with a missing or malformed factorVerificationAge payload now deny where they previously returned indeterminate. Callback-form auth.protect(has => ...) is unaffected unless the callback itself invokes the affected shapes.

    Separately, auth.protect() in @clerk/nextjs previously discarded authorization params (role, permission, feature, plan, reverification) whenever the same argument object also contained unauthenticatedUrl, unauthorizedUrl, or token. TypeScript's excess-property check caught this for inline object literals but did not apply once the argument was assigned to a variable, spread, or used from JavaScript. Mixed-shape calls like auth.protect({ role: 'org:admin', unauthorizedUrl: '/denied' }) or auth.protect({ permission: 'org:X', token: 'session_token' }) now correctly enforce the authorization check instead of silently letting every authenticated caller through.

  • Updated dependencies [d52b311, abaa339]:

v7.2.3

Compare Source

Patch Changes

v7.2.2

Compare Source

Patch Changes

v7.2.1

Patch Changes

v7.2.0

Minor Changes

  • Introduce internal <OAuthConsent /> component for rendering a zero-config OAuth consent screen on an OAuth authorize redirect page. (#​8289) by @​wobsoriano

    Usage example:

    import { OAuthConsent } from '@&#8203;clerk/nextjs';

export default function OAuthConsentPage() {
  return <OAuthConsent />;
}
Patch Changes

v7.1.0

Compare Source

Minor Changes
  • Introduce internal useOAuthConsent() hook for fetching OAuth consent screen metadata for the signed-in user. (#​8286) by @​jfoshee
Patch Changes

v7.0.12

Compare Source

Patch Changes

  • Re-exports useAPIKeys() hook. (#​8269) by @​wobsoriano

    Usage example:

    'use client';

import { useAPIKeys } from '@&#8203;clerk/nextjs';

export default function CustomAPIKeys() {
  const { data, isLoading, page, pageCount, fetchNext, fetchPrevious } = useAPIKeys({
    pageSize: 10,
    initialPage: 1,
  });

  if (isLoading) return <div>Loading...</div>;

  return (
    <ul>
      {data?.map(key => (
        <li key={key.id}>{key.name}</li>
      ))}
    </ul>
  );
}

  • Updated dependencies [fdac10e, 4e3cb0a, aa32bbc]:

v7.0.11

Compare Source

Patch Changes

v7.0.8

Compare Source

Patch Changes

v7.0.7

Compare Source

Patch Changes

v7.0.6

Compare Source

Patch Changes

v7.0.5

Compare Source

Patch Changes

v7.0.4

Compare Source

Patch Changes

v7.0.2

Compare Source

Patch Changes

v7.0.1

Compare Source

Patch Changes

v7.0.0

Compare Source

Major Changes
  • Align experimental/unstable prefixes to use consistent naming: (#​7361) by @​brkalow
    • Renamed all __unstable_*

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 5 times, most recently from 1d7368b to 80c3339 Compare March 11, 2026 02:45
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from a3ce101 to 3b949ec Compare March 20, 2026 17:49
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 3 times, most recently from 402c781 to 7284400 Compare April 7, 2026 04:25
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 3 times, most recently from f7623f6 to 9d5df31 Compare April 15, 2026 00:55
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch from 9d5df31 to f69f6d2 Compare April 16, 2026 09:05
@renovate renovate Bot changed the title fix(deps): update dependency @clerk/nextjs to v7 fix(deps): update dependency @clerk/nextjs to v7 - autoclosed Apr 16, 2026
@renovate renovate Bot closed this Apr 16, 2026
@renovate
renovate Bot deleted the renovate/clerk-nextjs-7.x branch April 16, 2026 23:16
@renovate renovate Bot changed the title fix(deps): update dependency @clerk/nextjs to v7 - autoclosed fix(deps): update dependency @clerk/nextjs to v7 Apr 18, 2026
@renovate renovate Bot reopened this Apr 18, 2026
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 6 times, most recently from 34d6939 to e0beb70 Compare April 25, 2026 04:44
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch from e0beb70 to c124414 Compare April 29, 2026 19:43
@renovate renovate Bot changed the title fix(deps): update dependency @clerk/nextjs to v7 fix(deps): update dependency @clerk/nextjs to v7 - autoclosed Apr 30, 2026
@renovate renovate Bot closed this Apr 30, 2026
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 3 times, most recently from cd575a5 to 03fd3c9 Compare May 27, 2026 22:09
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch from 03fd3c9 to 8b5596b Compare June 3, 2026 18:40
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 3 times, most recently from 749aa31 to 9241838 Compare June 15, 2026 23:07
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 5 times, most recently from 684460b to 58089d2 Compare June 23, 2026 21:53
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from 9a473ee to 5a22818 Compare July 1, 2026 22:11
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 8 times, most recently from 7cd7aae to 75e3984 Compare July 12, 2026 11:40
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from b5a824c to e9c6b4f Compare July 20, 2026 23:06
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch from e9c6b4f to dae919f Compare July 21, 2026 21:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants