From 424db9dab2043644c14aca57a2dc608dd3d87586 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 19:44:59 +0000 Subject: [PATCH 1/5] chore(repo): Update dependency next to v15.5.21 [SECURITY] --- packages/nextjs/package.json | 2 +- pnpm-workspace.yaml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index 6dbac746406..8e6bd0de6b4 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -92,7 +92,7 @@ }, "devDependencies": { "crypto-es": "^2.1.0", - "next": "15.5.19" + "next": "15.5.21" }, "peerDependencies": { "next": "^15.2.8 || ^15.3.8 || ^15.4.10 || ^15.5.9 || ^15.6.0-0 || ^16.0.10 || ^16.1.0-0", diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 8f3b74fa8bd..ac4251f672d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -55,6 +55,8 @@ minimumReleaseAgeExclude: - fast-uri@3.1.5 # Renovate security update: hono@4.12.34 - hono@4.12.34 + # Renovate security update: next@15.5.21 + - next@15.5.21 trustPolicy: no-downgrade trustPolicyExclude: From 5ea0343a5b7762165281c95d859eb5905edcb0bd Mon Sep 17 00:00:00 2001 From: wobsoriano Date: Thu, 27 Aug 2026 12:46:08 -0700 Subject: [PATCH 2/5] chore(nextjs): regenerate lockfile for next 15.5.21 and add changeset Renovate's artifact update OOM'd, so the branch had the package.json bump without the lockfile. Claude-Session: https://claude.ai/code/session_01Fovsdti3tG61y2Gm46Wnpm --- .changeset/nextjs-security-update.md | 5 + pnpm-lock.yaml | 132 ++++++++++++++++++++++++++- 2 files changed, 135 insertions(+), 2 deletions(-) create mode 100644 .changeset/nextjs-security-update.md diff --git a/.changeset/nextjs-security-update.md b/.changeset/nextjs-security-update.md new file mode 100644 index 00000000000..d0939c754d5 --- /dev/null +++ b/.changeset/nextjs-security-update.md @@ -0,0 +1,5 @@ +--- +'@clerk/nextjs': patch +--- + +Bump `next` devDependency floor to `15.5.21` to pick up upstream security fixes (including CVE-2026-44573 middleware bypass and CVE-2026-29057 request smuggling). diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 45745b15a08..348f8c164f6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -880,8 +880,8 @@ importers: specifier: ^2.1.0 version: 2.1.0 next: - specifier: 15.5.19 - version: 15.5.19(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: 15.5.21 + version: 15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) packages/nuxt: dependencies: @@ -4010,6 +4010,9 @@ packages: '@next/env@15.5.19': resolution: {integrity: sha512-sWWluFvcv5v3Fxznmf2ZfjyoVQt/64oCnYqS90inQWGzMPK1VjvekPiz3OPHKmFT30EnHrjlbyaHLt3M0vWabw==} + '@next/env@15.5.21': + resolution: {integrity: sha512-hjJI/GfrjWHgNguRIBzItjRRu0m3Nrz17GhxsjuHfjIvg9hyg3239REd2dpI+bpMTFuVrVprHzEQ19m++cDtbw==} + '@next/mdx@15.5.19': resolution: {integrity: sha512-W9eYr4l+qkWlOv7ZOLJTNp1SLtX4iYkUVSBWox6svcfRkLDMHhquvCUjN7kCJ2EaxKtJf4t/+pZDoNGUsd1HTw==} peerDependencies: @@ -4027,12 +4030,24 @@ packages: cpu: [arm64] os: [darwin] + '@next/swc-darwin-arm64@15.5.21': + resolution: {integrity: sha512-ZfjqPEdi6TRC/fWx7UDbwb1fbVgyh2uD5tVTRKIDZDlYM+UNuE/LafDG2fwuAoZilADpABh46OY/F5qf9JjqLQ==} + engines: {node: '>= 10'} + cpu: [arm64] + os: [darwin] + '@next/swc-darwin-x64@15.5.19': resolution: {integrity: sha512-291KFcsIQ3OenRdiUDFOR6W3wezzH4auENXm1gbm1Bjd4ANMMRgxPrWTUztQN43BnVoVuMnHCrLeECIMwgFKbA==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] + '@next/swc-darwin-x64@15.5.21': + resolution: {integrity: sha512-TlCf1NpxgQLzTrexuev75xwmNCJMd1/qkJpTVP1GRRcih93hlIBn1P72hkh8T0gnRFr6BmWksQtbyG3jT6jnww==} + engines: {node: '>= 10'} + cpu: [x64] + os: [darwin] + '@next/swc-linux-arm64-gnu@15.5.19': resolution: {integrity: sha512-WeH+nelQyyMeE2f8FxBRZNrGipya5zHZV2vjzfCOAYyiI6am+NbnWAAldOBFQBB2w0DjJcsvrKqoFT2b7+5YoA==} engines: {node: '>= 10'} @@ -4040,6 +4055,13 @@ packages: os: [linux] libc: [glibc] + '@next/swc-linux-arm64-gnu@15.5.21': + resolution: {integrity: sha512-LXRsq1p+HvHSi7ygwNcSEEcK0zuo5jS75ZlqFHtOH+LF7qntXAJVJxah+1Pi/GyBm7EpkwU7m4EgbvIKrMqm9A==} + engines: {node: '>= 10'} + cpu: [arm64] + os: [linux] + libc: [glibc] + '@next/swc-linux-arm64-musl@15.5.19': resolution: {integrity: sha512-5xTOE0lDlDCSSfp+BAif7j17VRRCjWp//ZPZy6NI0QpdrhxtQnsZguSx0xAAZ0c9XZLrLLwCe/XVe5YPrRilKw==} engines: {node: '>= 10'} @@ -4047,6 +4069,13 @@ packages: os: [linux] libc: [musl] + '@next/swc-linux-arm64-musl@15.5.21': + resolution: {integrity: sha512-hyGixhFxpDKjqoev6l4KlcRBlt9AXWrGhDZwmwg49sMJM5tnKQPSi+SEj9+e5n+l/bthRGZUdh59GKIs6lQPRw==} + engines: {node: '>= 10'} + cpu: [arm64] + os: [linux] + libc: [musl] + '@next/swc-linux-x64-gnu@15.5.19': resolution: {integrity: sha512-LTxRmMgqqMv05Had879W00Fm53quiJd3Zuz8h1JSNJ3nGSlbZ/7Tjs1tKyScgN3Au3t3MyPsjPlq60fMmSHLsg==} engines: {node: '>= 10'} @@ -4054,6 +4083,13 @@ packages: os: [linux] libc: [glibc] + '@next/swc-linux-x64-gnu@15.5.21': + resolution: {integrity: sha512-qfE+YfOba6S2+13e8qn1/UozDVNZ2clBlrs8UtDoax4s8ediu6sq93z66OEHUYlb69Tffh5JTNkgtsAKiSuugg==} + engines: {node: '>= 10'} + cpu: [x64] + os: [linux] + libc: [glibc] + '@next/swc-linux-x64-musl@15.5.19': resolution: {integrity: sha512-eoNQSpA5PQfB9wBO4RA47MTDXWz1fizy9Y3Z6e4DetYIF3dvjuu8sj7aIGn/bFCU6lnFzTK34NtCaffP4NsQ7Q==} engines: {node: '>= 10'} @@ -4061,18 +4097,37 @@ packages: os: [linux] libc: [musl] + '@next/swc-linux-x64-musl@15.5.21': + resolution: {integrity: sha512-BXLGG+EvIwp/Rrgl6HY8sqvD6BOUOIRz8/naDbeLNX7mlA5H2XRcL6MW/0IGnJISfj5BA9gNhFyJj5yOoiIDJQ==} + engines: {node: '>= 10'} + cpu: [x64] + os: [linux] + libc: [musl] + '@next/swc-win32-arm64-msvc@15.5.19': resolution: {integrity: sha512-6UNt2dFuCHOe446sm/Kp69nUe8/wIhnh9bm6Xcqw4qEWCOppLMOvhTBVgvM7invVUNr4SPpP6NOQsACtn2IN9Q==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] + '@next/swc-win32-arm64-msvc@15.5.21': + resolution: {integrity: sha512-tNGNOlT0Wn7E4IMsSnufjXN/l2L2/AGdLLpa2vzS89SYCBuihgLn3ngLsIrvndAnWo9nAkus+4gZHTI/Ijx9HA==} + engines: {node: '>= 10'} + cpu: [arm64] + os: [win32] + '@next/swc-win32-x64-msvc@15.5.19': resolution: {integrity: sha512-PhmojAHyqMne56HBLGu9dhDnHPuFmEjrXSQMM/nW0J6j849lk3ESrVtqNJcCk8CKOV7brpTTbaYAjwKPzKM69w==} engines: {node: '>= 10'} cpu: [x64] os: [win32] + '@next/swc-win32-x64-msvc@15.5.21': + resolution: {integrity: sha512-DmIdWmC9p4rdNIiQqo8ap0+Cnj6kKtTZnuSCxoYydSc8sgpDgAg9wFhxplunak9imLV0pTvc5WVCOHwm5eHLtQ==} + engines: {node: '>= 10'} + cpu: [x64] + os: [win32] + '@nicolo-ribaudo/chokidar-2@2.1.8-no-fsevents.3': resolution: {integrity: sha512-s88O1aVtXftvp5bCPB7WnmXc5IwOZZ7YPuwNPt+GtOOXpPvad1LfbmjYv+qII7zP6RU2QGnqve27dnLycEnyEQ==} @@ -11866,6 +11921,27 @@ packages: sass: optional: true + next@15.5.21: + resolution: {integrity: sha512-/TsdBtkWLhkl+NVL3Uqws2UphNd6IPzOtzSk1fHaf+0P7GQKLZDUytyhns/Ykbzdy9+YRjwG7ONvrHaaTDdFqQ==} + engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} + hasBin: true + peerDependencies: + '@opentelemetry/api': ^1.1.0 + '@playwright/test': ^1.51.1 + babel-plugin-react-compiler: '*' + react: 18.3.1 + react-dom: 18.3.1 + sass: ^1.3.0 + peerDependenciesMeta: + '@opentelemetry/api': + optional: true + '@playwright/test': + optional: true + babel-plugin-react-compiler: + optional: true + sass: + optional: true + nice-try@1.0.5: resolution: {integrity: sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==} @@ -18702,6 +18778,8 @@ snapshots: '@next/env@15.5.19': {} + '@next/env@15.5.21': {} + '@next/mdx@15.5.19(@mdx-js/loader@3.1.1(webpack@5.102.1(esbuild@0.27.7)))(@mdx-js/react@3.1.1(@types/react@18.3.28)(react@18.3.1))': dependencies: source-map: 0.7.6 @@ -18712,27 +18790,51 @@ snapshots: '@next/swc-darwin-arm64@15.5.19': optional: true + '@next/swc-darwin-arm64@15.5.21': + optional: true + '@next/swc-darwin-x64@15.5.19': optional: true + '@next/swc-darwin-x64@15.5.21': + optional: true + '@next/swc-linux-arm64-gnu@15.5.19': optional: true + '@next/swc-linux-arm64-gnu@15.5.21': + optional: true + '@next/swc-linux-arm64-musl@15.5.19': optional: true + '@next/swc-linux-arm64-musl@15.5.21': + optional: true + '@next/swc-linux-x64-gnu@15.5.19': optional: true + '@next/swc-linux-x64-gnu@15.5.21': + optional: true + '@next/swc-linux-x64-musl@15.5.19': optional: true + '@next/swc-linux-x64-musl@15.5.21': + optional: true + '@next/swc-win32-arm64-msvc@15.5.19': optional: true + '@next/swc-win32-arm64-msvc@15.5.21': + optional: true + '@next/swc-win32-x64-msvc@15.5.19': optional: true + '@next/swc-win32-x64-msvc@15.5.21': + optional: true + '@nicolo-ribaudo/chokidar-2@2.1.8-no-fsevents.3': optional: true @@ -28315,6 +28417,32 @@ snapshots: - '@babel/core' - babel-plugin-macros + next@15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + dependencies: + '@next/env': 15.5.21 + '@swc/helpers': 0.5.15 + caniuse-lite: 1.0.30001793 + postcss: 8.4.31 + react: 18.3.1 + react-dom: 18.3.1(react@18.3.1) + styled-jsx: 5.1.6(@babel/core@7.29.7)(babel-plugin-macros@3.1.0)(react@18.3.1) + optionalDependencies: + '@next/swc-darwin-arm64': 15.5.21 + '@next/swc-darwin-x64': 15.5.21 + '@next/swc-linux-arm64-gnu': 15.5.21 + '@next/swc-linux-arm64-musl': 15.5.21 + '@next/swc-linux-x64-gnu': 15.5.21 + '@next/swc-linux-x64-musl': 15.5.21 + '@next/swc-win32-arm64-msvc': 15.5.21 + '@next/swc-win32-x64-msvc': 15.5.21 + '@opentelemetry/api': 1.9.0 + '@playwright/test': 1.62.1 + babel-plugin-react-compiler: 1.0.0 + sharp: 0.34.5 + transitivePeerDependencies: + - '@babel/core' + - babel-plugin-macros + nice-try@1.0.5: {} nitropack@2.13.4(idb-keyval@6.2.1)(oxc-parser@0.133.0)(rolldown@1.1.0): From aaf0a62279aea0fded9a2d9a9365c82f74d38c42 Mon Sep 17 00:00:00 2001 From: wobsoriano Date: Thu, 27 Aug 2026 12:48:26 -0700 Subject: [PATCH 3/5] chore(nextjs): dedupe next to 15.5.21 across workspace Claude-Session: https://claude.ai/code/session_01Fovsdti3tG61y2Gm46Wnpm --- pnpm-lock.yaml | 136 ++----------------------------------------------- 1 file changed, 4 insertions(+), 132 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 348f8c164f6..bf782f41d34 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -847,7 +847,7 @@ importers: version: 2.13.6(@types/node@25.6.0)(typescript@6.0.3) next: specifier: '>=15.5.18' - version: 15.5.19(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + version: 15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) react: specifier: 18.3.1 version: 18.3.1 @@ -881,7 +881,7 @@ importers: version: 2.1.0 next: specifier: 15.5.21 - version: 15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + version: 15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) packages/nuxt: dependencies: @@ -1068,7 +1068,7 @@ importers: version: 1.17.0(react@18.3.1) next: specifier: ^15.0.0 - version: 15.5.19(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + version: 15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) next-themes: specifier: ^0.4.6 version: 0.4.6(react-dom@18.3.1(react@18.3.1))(react@18.3.1) @@ -4007,9 +4007,6 @@ packages: resolution: {integrity: sha512-enkZYyuCdo+9jneCPE/0fjIta4wWnvVN9hBo2HuiMpRF0q3lzv1J6b/cl7i0mxZUKhBrV3aCKDBQnCOhwKbPmQ==} engines: {node: '>= 10'} - '@next/env@15.5.19': - resolution: {integrity: sha512-sWWluFvcv5v3Fxznmf2ZfjyoVQt/64oCnYqS90inQWGzMPK1VjvekPiz3OPHKmFT30EnHrjlbyaHLt3M0vWabw==} - '@next/env@15.5.21': resolution: {integrity: sha512-hjJI/GfrjWHgNguRIBzItjRRu0m3Nrz17GhxsjuHfjIvg9hyg3239REd2dpI+bpMTFuVrVprHzEQ19m++cDtbw==} @@ -4024,37 +4021,18 @@ packages: '@mdx-js/react': optional: true - '@next/swc-darwin-arm64@15.5.19': - resolution: {integrity: sha512-jx9wWlTKueHKPvVOndyr7WuaevWCkuYqsQ8gC0TMPKAVWG3MhcdMrjfo9tvIZNXd0QOUYXXvAcZ325y8Uq7uzg==} - engines: {node: '>= 10'} - cpu: [arm64] - os: [darwin] - '@next/swc-darwin-arm64@15.5.21': resolution: {integrity: sha512-ZfjqPEdi6TRC/fWx7UDbwb1fbVgyh2uD5tVTRKIDZDlYM+UNuE/LafDG2fwuAoZilADpABh46OY/F5qf9JjqLQ==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.5.19': - resolution: {integrity: sha512-291KFcsIQ3OenRdiUDFOR6W3wezzH4auENXm1gbm1Bjd4ANMMRgxPrWTUztQN43BnVoVuMnHCrLeECIMwgFKbA==} - engines: {node: '>= 10'} - cpu: [x64] - os: [darwin] - '@next/swc-darwin-x64@15.5.21': resolution: {integrity: sha512-TlCf1NpxgQLzTrexuev75xwmNCJMd1/qkJpTVP1GRRcih93hlIBn1P72hkh8T0gnRFr6BmWksQtbyG3jT6jnww==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.5.19': - resolution: {integrity: sha512-WeH+nelQyyMeE2f8FxBRZNrGipya5zHZV2vjzfCOAYyiI6am+NbnWAAldOBFQBB2w0DjJcsvrKqoFT2b7+5YoA==} - engines: {node: '>= 10'} - cpu: [arm64] - os: [linux] - libc: [glibc] - '@next/swc-linux-arm64-gnu@15.5.21': resolution: {integrity: sha512-LXRsq1p+HvHSi7ygwNcSEEcK0zuo5jS75ZlqFHtOH+LF7qntXAJVJxah+1Pi/GyBm7EpkwU7m4EgbvIKrMqm9A==} engines: {node: '>= 10'} @@ -4062,13 +4040,6 @@ packages: os: [linux] libc: [glibc] - '@next/swc-linux-arm64-musl@15.5.19': - resolution: {integrity: sha512-5xTOE0lDlDCSSfp+BAif7j17VRRCjWp//ZPZy6NI0QpdrhxtQnsZguSx0xAAZ0c9XZLrLLwCe/XVe5YPrRilKw==} - engines: {node: '>= 10'} - cpu: [arm64] - os: [linux] - libc: [musl] - '@next/swc-linux-arm64-musl@15.5.21': resolution: {integrity: sha512-hyGixhFxpDKjqoev6l4KlcRBlt9AXWrGhDZwmwg49sMJM5tnKQPSi+SEj9+e5n+l/bthRGZUdh59GKIs6lQPRw==} engines: {node: '>= 10'} @@ -4076,13 +4047,6 @@ packages: os: [linux] libc: [musl] - '@next/swc-linux-x64-gnu@15.5.19': - resolution: {integrity: sha512-LTxRmMgqqMv05Had879W00Fm53quiJd3Zuz8h1JSNJ3nGSlbZ/7Tjs1tKyScgN3Au3t3MyPsjPlq60fMmSHLsg==} - engines: {node: '>= 10'} - cpu: [x64] - os: [linux] - libc: [glibc] - '@next/swc-linux-x64-gnu@15.5.21': resolution: {integrity: sha512-qfE+YfOba6S2+13e8qn1/UozDVNZ2clBlrs8UtDoax4s8ediu6sq93z66OEHUYlb69Tffh5JTNkgtsAKiSuugg==} engines: {node: '>= 10'} @@ -4090,13 +4054,6 @@ packages: os: [linux] libc: [glibc] - '@next/swc-linux-x64-musl@15.5.19': - resolution: {integrity: sha512-eoNQSpA5PQfB9wBO4RA47MTDXWz1fizy9Y3Z6e4DetYIF3dvjuu8sj7aIGn/bFCU6lnFzTK34NtCaffP4NsQ7Q==} - engines: {node: '>= 10'} - cpu: [x64] - os: [linux] - libc: [musl] - '@next/swc-linux-x64-musl@15.5.21': resolution: {integrity: sha512-BXLGG+EvIwp/Rrgl6HY8sqvD6BOUOIRz8/naDbeLNX7mlA5H2XRcL6MW/0IGnJISfj5BA9gNhFyJj5yOoiIDJQ==} engines: {node: '>= 10'} @@ -4104,24 +4061,12 @@ packages: os: [linux] libc: [musl] - '@next/swc-win32-arm64-msvc@15.5.19': - resolution: {integrity: sha512-6UNt2dFuCHOe446sm/Kp69nUe8/wIhnh9bm6Xcqw4qEWCOppLMOvhTBVgvM7invVUNr4SPpP6NOQsACtn2IN9Q==} - engines: {node: '>= 10'} - cpu: [arm64] - os: [win32] - '@next/swc-win32-arm64-msvc@15.5.21': resolution: {integrity: sha512-tNGNOlT0Wn7E4IMsSnufjXN/l2L2/AGdLLpa2vzS89SYCBuihgLn3ngLsIrvndAnWo9nAkus+4gZHTI/Ijx9HA==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.5.19': - resolution: {integrity: sha512-PhmojAHyqMne56HBLGu9dhDnHPuFmEjrXSQMM/nW0J6j849lk3ESrVtqNJcCk8CKOV7brpTTbaYAjwKPzKM69w==} - engines: {node: '>= 10'} - cpu: [x64] - os: [win32] - '@next/swc-win32-x64-msvc@15.5.21': resolution: {integrity: sha512-DmIdWmC9p4rdNIiQqo8ap0+Cnj6kKtTZnuSCxoYydSc8sgpDgAg9wFhxplunak9imLV0pTvc5WVCOHwm5eHLtQ==} engines: {node: '>= 10'} @@ -11900,27 +11845,6 @@ packages: react: 18.3.1 react-dom: 18.3.1 - next@15.5.19: - resolution: {integrity: sha512-xNOW6tYshGX1/Oi3F8uuk4gpDeWsSUE/1Z0G5uUMekIxaQ0xc03UXd9II0VQHYMWviMeA0OHpJFAKsHf8bTYVg==} - engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} - hasBin: true - peerDependencies: - '@opentelemetry/api': ^1.1.0 - '@playwright/test': ^1.51.1 - babel-plugin-react-compiler: '*' - react: 18.3.1 - react-dom: 18.3.1 - sass: ^1.3.0 - peerDependenciesMeta: - '@opentelemetry/api': - optional: true - '@playwright/test': - optional: true - babel-plugin-react-compiler: - optional: true - sass: - optional: true - next@15.5.21: resolution: {integrity: sha512-/TsdBtkWLhkl+NVL3Uqws2UphNd6IPzOtzSk1fHaf+0P7GQKLZDUytyhns/Ykbzdy9+YRjwG7ONvrHaaTDdFqQ==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} @@ -18776,8 +18700,6 @@ snapshots: - '@emnapi/core' - '@emnapi/runtime' - '@next/env@15.5.19': {} - '@next/env@15.5.21': {} '@next/mdx@15.5.19(@mdx-js/loader@3.1.1(webpack@5.102.1(esbuild@0.27.7)))(@mdx-js/react@3.1.1(@types/react@18.3.28)(react@18.3.1))': @@ -18787,51 +18709,27 @@ snapshots: '@mdx-js/loader': 3.1.1(webpack@5.102.1(esbuild@0.27.7)) '@mdx-js/react': 3.1.1(@types/react@18.3.28)(react@18.3.1) - '@next/swc-darwin-arm64@15.5.19': - optional: true - '@next/swc-darwin-arm64@15.5.21': optional: true - '@next/swc-darwin-x64@15.5.19': - optional: true - '@next/swc-darwin-x64@15.5.21': optional: true - '@next/swc-linux-arm64-gnu@15.5.19': - optional: true - '@next/swc-linux-arm64-gnu@15.5.21': optional: true - '@next/swc-linux-arm64-musl@15.5.19': - optional: true - '@next/swc-linux-arm64-musl@15.5.21': optional: true - '@next/swc-linux-x64-gnu@15.5.19': - optional: true - '@next/swc-linux-x64-gnu@15.5.21': optional: true - '@next/swc-linux-x64-musl@15.5.19': - optional: true - '@next/swc-linux-x64-musl@15.5.21': optional: true - '@next/swc-win32-arm64-msvc@15.5.19': - optional: true - '@next/swc-win32-arm64-msvc@15.5.21': optional: true - '@next/swc-win32-x64-msvc@15.5.19': - optional: true - '@next/swc-win32-x64-msvc@15.5.21': optional: true @@ -28391,33 +28289,7 @@ snapshots: react: 18.3.1 react-dom: 18.3.1(react@18.3.1) - next@15.5.19(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): - dependencies: - '@next/env': 15.5.19 - '@swc/helpers': 0.5.15 - caniuse-lite: 1.0.30001793 - postcss: 8.4.31 - react: 18.3.1 - react-dom: 18.3.1(react@18.3.1) - styled-jsx: 5.1.6(@babel/core@7.29.7)(babel-plugin-macros@3.1.0)(react@18.3.1) - optionalDependencies: - '@next/swc-darwin-arm64': 15.5.19 - '@next/swc-darwin-x64': 15.5.19 - '@next/swc-linux-arm64-gnu': 15.5.19 - '@next/swc-linux-arm64-musl': 15.5.19 - '@next/swc-linux-x64-gnu': 15.5.19 - '@next/swc-linux-x64-musl': 15.5.19 - '@next/swc-win32-arm64-msvc': 15.5.19 - '@next/swc-win32-x64-msvc': 15.5.19 - '@opentelemetry/api': 1.9.0 - '@playwright/test': 1.62.1 - babel-plugin-react-compiler: 1.0.0 - sharp: 0.34.5 - transitivePeerDependencies: - - '@babel/core' - - babel-plugin-macros - - next@15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + next@15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.62.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: '@next/env': 15.5.21 '@swc/helpers': 0.5.15 From 417110d8a26421b687de27772976e44fa74c6166 Mon Sep 17 00:00:00 2001 From: wobsoriano Date: Thu, 27 Aug 2026 15:52:55 -0700 Subject: [PATCH 4/5] chore(repo): Remove changesets for devDependency-only security bumps The next and hono updates only raise devDependency floors, so they do not change published package behavior and do not need a release. Claude-Session: https://claude.ai/code/session_01PEDVeaJ5AS6QZzxrh67YWb --- .changeset/hono-security-update.md | 5 ----- .changeset/nextjs-security-update.md | 5 ----- 2 files changed, 10 deletions(-) delete mode 100644 .changeset/hono-security-update.md delete mode 100644 .changeset/nextjs-security-update.md diff --git a/.changeset/hono-security-update.md b/.changeset/hono-security-update.md deleted file mode 100644 index e0e8a5afa3f..00000000000 --- a/.changeset/hono-security-update.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@clerk/hono': patch ---- - -Bump `hono` devDependency floor to `^4.12.34` to pick up an upstream security fix (CVE-2026-69207, ReDoS in the CORS middleware). diff --git a/.changeset/nextjs-security-update.md b/.changeset/nextjs-security-update.md deleted file mode 100644 index d0939c754d5..00000000000 --- a/.changeset/nextjs-security-update.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@clerk/nextjs': patch ---- - -Bump `next` devDependency floor to `15.5.21` to pick up upstream security fixes (including CVE-2026-44573 middleware bypass and CVE-2026-29057 request smuggling). From 9b100ada1f1fd3e7cfbd8be6cbd37d581e444d2a Mon Sep 17 00:00:00 2001 From: wobsoriano Date: Fri, 28 Aug 2026 09:46:56 -0700 Subject: [PATCH 5/5] chore(repo): drop stale minimumReleaseAgeExclude entries next@15.5.21, hono@4.12.34 and fast-uri@3.1.5 were all published well past the 2 day minimumReleaseAge, so the excludes never took effect. Claude-Session: https://claude.ai/code/session_01Fovsdti3tG61y2Gm46Wnpm --- pnpm-workspace.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ac4251f672d..04cc9a5cb28 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -51,12 +51,6 @@ minimumReleaseAgeExclude: - astro@6.1.6 # Renovate security update: vite@6.4.2 - vite@6.4.2 - # Renovate security update: fast-uri@3.1.5 - - fast-uri@3.1.5 - # Renovate security update: hono@4.12.34 - - hono@4.12.34 - # Renovate security update: next@15.5.21 - - next@15.5.21 trustPolicy: no-downgrade trustPolicyExclude: