Skip to content

Update dependency @clerk/nextjs to v7 - #279

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/clerk-nextjs-7.x
Open

Update dependency @clerk/nextjs to v7#279
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/clerk-nextjs-7.x

Conversation

@renovate

@renovate renovate Bot commented Mar 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@clerk/nextjs (source) ^6.39.6 → ^7.7.1 age confidence

Release Notes

clerk/javascript (@​clerk/nextjs)

v7.7.1

Patch Changes

v7.7.0

Minor Changes

  • Add <InviteMembersButton />, a control component that opens the organization invite-members form in a modal when clicked, working like <SignInButton mode="modal">. (#​9124) by @​alexcarpenter

    Wrap your own button (or omit children for a default one). The button requires an active organization and should be rendered for members who can manage memberships (org:sys_memberships:manage). Opening it without an active organization or that permission is a no-op in production, and throws a descriptive error in development.

    import { InviteMembersButton } from '@clerk/nextjs';

<InviteMembersButton>
  <button>Invite members</button>
</InviteMembersButton>;

    This also adds Clerk.openInviteMembers() and Clerk.closeInviteMembers() for opening and closing the modal programmatically.

Patch Changes

v7.6.5

Patch Changes

v7.6.4

Compare Source

Patch Changes

v7.6.3

Compare Source

Patch Changes

v7.6.2

Compare Source

Patch Changes

v7.6.1

Compare Source

Patch Changes

v7.6.0

Minor Changes
  • Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#​9223) by @​thiskevinwang
Patch Changes

v7.5.22

Patch Changes
  • Remove the redundant https://*.client.protect.clerk.com source from CSP headers generated by clerkMiddleware(). (#​9207) by @​mwickett

v7.5.21

Compare Source

Patch Changes

v7.5.20

Compare Source

Patch Changes

v7.5.19

Compare Source

Patch Changes

v7.5.18

Compare Source

Patch Changes

v7.5.17

Compare Source

Patch Changes

v7.5.16

Compare Source

Patch Changes

v7.5.15

Compare Source

Patch Changes

v7.5.14

Compare Source

Patch Changes

v7.5.13

Compare Source

Patch Changes

  • createPathMatcher() and createRouteMatcher() route suggestions now use the :path* subtree form (e.g. /dashboard/:path*) instead of (.*). Unlike /dashboard(.*), which also matches sibling routes such as /dashboardxyz, /dashboard/:path* matches only /dashboard and its path-segment subtree. The new suggestion type is exported as WithPathSegmentWildcard; the existing WithPathPatternWildcard type is unchanged (now deprecated), and (.*) patterns keep working. This only changes the type-level autocomplete suggestion. (#​9057) by @​jacekradko

  • Updated dependencies [1efc7e5, 5028b54, 2e1fec7]:

v7.5.12

Compare Source

Patch Changes

v7.5.11

Patch Changes

v7.5.10

Patch Changes

v7.5.9

Compare Source

Patch Changes

v7.5.8

Compare Source

Patch Changes

v7.5.7

Compare Source

Patch Changes

v7.5.6

Compare Source

Patch Changes

v7.5.5

Patch Changes

v7.5.4

Patch Changes

v7.5.3

Compare Source

Patch Changes

v7.5.2

Compare Source

Patch Changes

v7.5.1

Compare Source

Patch Changes

v7.5.0

Compare Source

Minor Changes

  • Remove the <ConfigureSSO /> component from the public API in favor of usage within OrganizationProfile (#​8779) by @​LauraBeatris

    Removing these exports has no breaking changes impact on production applications, as was never released as a GA component

Patch Changes

v7.4.3

Compare Source

Patch Changes

v7.4.2

Compare Source

Patch Changes

v7.4.1

Compare Source

Patch Changes

v7.4.0

Compare Source

Minor Changes
Patch Changes

v7.3.7

Patch Changes

v7.3.6

Patch Changes

v7.3.5

Compare Source

Patch Changes

v7.3.4

Compare Source

Patch Changes

v7.3.3

Compare Source

Patch Changes

v7.3.2

Compare Source

Patch Changes

v7.3.1

Compare Source

Patch Changes

v7.3.0

Compare Source

Minor Changes

  • Expose OAuthConsent as a public component export across React-based SDKs. (#​8381) by @​wobsoriano

    Example:

    import { OAuthConsent } from '@clerk/react';

export default function Page() {
  return <OAuthConsent />;
}
Patch Changes

v7.2.9

Compare Source

Patch Changes

v7.2.8

Compare Source

Patch Changes

  • Use a constant-time comparison when validating the integrity signature on the middleware-to-origin auth header handoff (assertTokenSignature). The previous !== compare was timing-variable; the new helper is synchronous and runtime-agnostic so it works in both Node and Edge Runtime. (#​8411) by @​jacekradko

  • Auto-proxy FAPI requests for .vercel.app subdomains. When deployed to a .vercel.app domain without explicit proxy or domain configuration, the SDK automatically routes Frontend API requests through /__clerk on the app's own origin. This enables Clerk production mode on Vercel deployments without manual proxy setup. (#​8035) by @​brkalow

  • Updated dependencies [9b57986, a9f9b29, e0a63f9]:

v7.2.7

Compare Source

Patch Changes

v7.2.6

Patch Changes

v7.2.5

Patch Changes

  • Refactor clerkMiddleware internals to factor the post-authentication pipeline (handler invocation, CSP, redirects, response decoration) into a private runHandlerWithRequestState helper. Pure refactor — no behavioral change. (#​8368) by @​jacekradko

  • Updated dependencies [93855c2]:

v7.2.4

Patch Changes

  • Add helpful TypeScript error for incorrect auth import path (#​8358) by @​jacekradko

  • Fix an authorization bypass in has(), auth.protect(), and related predicates when a single call combined conditions from more than one dimension (for example, { permission, reverification } or { feature, permission }). A dimension that should have denied the request was treated as indeterminate and ignored by the combining logic, allowing other passing dimensions to carry the result and authorize the call when it should have failed closed. (#​8372) by @​nikosdouvlis

    Behavior is now:

    • When a requested dimension cannot be satisfied because the underlying session data is missing, malformed, or invalid, the call denies. Previously these cases were treated as indeterminate and ignored, which could let another passing dimension carry the call.
    • Fixed a minor bug where session.checkAuthorization() was building authorization options from the membership row id instead of the organization id.

    Single-condition role, permission, feature, and plan checks (has({ permission }), etc.) are unchanged. Single-condition reverification checks are unchanged on well-formed session data; calls with a missing or malformed factorVerificationAge payload now deny where they previously returned indeterminate. Callback-form auth.protect(has => ...) is unaffected unless the callback itself invokes the affected shapes.

    Separately, auth.protect() in @clerk/nextjs previously discarded authorization params (role, permission, feature, plan, reverification) whenever the same argument object also contained unauthenticatedUrl, unauthorizedUrl, or token. TypeScript's excess-property check caught this for inline object literals but did not apply once the argument was assigned to a variable, spread, or used from JavaScript. Mixed-shape calls like auth.protect({ role: 'org:admin', unauthorizedUrl: '/denied' }) or auth.protect({ permission: 'org:X', token: 'session_token' }) now correctly enforce the authorization check instead of silently letting every authenticated caller through.

  • Updated dependencies [d52b311, abaa339]:

v7.2.3

Compare Source

Patch Changes

v7.2.2

Compare Source

Patch Changes

v7.2.1

Patch Changes

v7.2.0

Minor Changes

  • Introduce internal <OAuthConsent /> component for rendering a zero-config OAuth consent screen on an OAuth authorize redirect page. (#​8289) by @​wobsoriano

    Usage example:

    import { OAuthConsent } from '@clerk/nextjs';

export default function OAuthConsentPage() {
  return <OAuthConsent />;
}
Patch Changes

v7.1.0

Compare Source

Minor Changes
  • Introduce internal useOAuthConsent() hook for fetching OAuth consent screen metadata for the signed-in user. (#​8286) by @​jfoshee
Patch Changes

v7.0.12

Compare Source

Patch Changes

  • Re-exports useAPIKeys() hook. (#​8269) by @​wobsoriano

    Usage example:

    'use client';

import { useAPIKeys } from '@clerk/nextjs';

export default function CustomAPIKeys() {
  const { data, isLoading, page, pageCount, fetchNext, fetchPrevious } = useAPIKeys({
    pageSize: 10,
    initialPage: 1,
  });

  if (isLoading) return <div>Loading...</div>;

  return (
    <ul>
      {data?.map(key => (
        <li key={key.id}>{key.name}</li>
      ))}
    </ul>
  );
}

  • Updated dependencies [fdac10e, 4e3cb0a, aa32bbc]:

v7.0.11

Compare Source

Patch Changes

v7.0.8

[Compare Source](https://redirect.github.com/clerk/javascript/compare/@cler

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from bc42437 to 2f88dbb Compare March 13, 2026 21:18
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 3 times, most recently from ac716f7 to 5f4bec2 Compare March 20, 2026 13:27
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 2 times, most recently from 865db3d to b731882 Compare April 1, 2026 05:07
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from 20bd70b to b65b697 Compare April 13, 2026 20:43
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from 34a0c98 to ca3559c Compare April 17, 2026 21:20
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 6 times, most recently from 995944f to 10ab0e1 Compare April 24, 2026 22:49
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 5 times, most recently from 27a3a22 to 2f8f880 Compare May 15, 2026 20:34
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 2 times, most recently from 2014f7d to b547692 Compare May 21, 2026 19:08
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 5 times, most recently from f98f248 to c27e434 Compare June 30, 2026 22:10
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from 8d94e67 to 290835d Compare July 8, 2026 19:50
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 6 times, most recently from a6a3e6d to 5a75079 Compare July 18, 2026 00:45
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 4 times, most recently from f6ee9ec to e237fe7 Compare July 23, 2026 20:37
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 5 times, most recently from e0fceb5 to 108ccf4 Compare August 3, 2026 22:52
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 3 times, most recently from 33f9f11 to 2330e98 Compare August 7, 2026 14:29
@renovate
renovate Bot force-pushed the renovate/clerk-nextjs-7.x branch 2 times, most recently from a5bbcbe to 50bd7a8 Compare August 12, 2026 00:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants