Skip to content

chore(deps): update dependency @clerk/nextjs to v6.23.3 [security]#161

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-clerk-nextjs-vulnerability
Open

chore(deps): update dependency @clerk/nextjs to v6.23.3 [security]#161
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-clerk-nextjs-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jul 9, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@clerk/nextjs (source) 6.12.7 → 6.23.3 age confidence

GitHub Vulnerability Alerts

CVE-2025-53548

Impact

Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

Patches

  • @clerk/backend: the helper has been patched as of 2.4.0
  • @clerk/astro: the helper has been patched as of 2.10.2
  • @clerk/express: the helper has been patched as of 1.7.4
  • @clerk/fastify: the helper has been patched as of 2.4.4
  • @clerk/nextjs: the helper has been patched as of 6.23.3
  • @clerk/nuxt: the helper has been patched as of 1.7.5
  • @clerk/react-router: the helper has been patched as of 1.6.4
  • @clerk/remix: the helper has been patched as of 4.8.5
  • @clerk/tanstack-react-start: the helper has been patched as of 0.18.3

Resolution

The issue was resolved in @clerk/backend 2.4.0 by:

  • Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per this documentation.

Release Notes

clerk/javascript (@​clerk/nextjs)

v6.23.3

Compare Source

Patch Changes

v6.23.2

Compare Source

Patch Changes

v6.23.1

Compare Source

Patch Changes

v6.23.0

Compare Source

Minor Changes

  • Fix auth.protect() unauthorized error propagation within middleware (#​6169) by @​wobsoriano

    • Optimize auth() calls to avoid unnecessary verification calls when the provided token type is not in the acceptsToken array. (#​6123) by @​wobsoriano

    • Add handling for invalid token types when acceptsToken is an array in authenticateRequest(): now returns a clear unauthenticated state (tokenType: null) if the token is not in the accepted list.

Patch Changes

v6.22.0

Compare Source

Minor Changes

  • Add <APIKeys /> component. This component will initially be in early access and not recommended for production usage just yet. (#​5858) by @​wobsoriano

  • Respect acceptsToken when returning unauthenticated session or machine object. (#​6112) by @​wobsoriano

Patch Changes

v6.21.0

Compare Source

Minor Changes

  • Introduces machine authentication, supporting four token types: api_key, oauth_token, machine_token, and session_token. For backwards compatibility, session_token remains the default when no token type is specified. This enables machine-to-machine authentication and use cases such as API keys and OAuth integrations. Existing applications continue to work without modification. (#​5689) by @​wobsoriano

    You can specify which token types are allowed for a given route or handler using the acceptsToken property in the auth() helper, or the token property in the auth.protect() helper. Each can be set to a specific type, an array of types, or 'any' to accept all supported tokens.

    Example usage in Nextjs middleware:

    import { clerkMiddleware, createRouteMatcher } from '@&#8203;clerk/nextjs/server';

const isOAuthAccessible = createRouteMatcher(['/oauth(.*)']);
const isApiKeyAccessible = createRouteMatcher(['/api(.*)']);
const isMachineTokenAccessible = createRouteMatcher(['/m2m(.*)']);
const isUserAccessible = createRouteMatcher(['/user(.*)']);
const isAccessibleToAnyValidToken = createRouteMatcher(['/any(.*)']);

export default clerkMiddleware(async (auth, req) => {
  if (isOAuthAccessible(req)) await auth.protect({ token: 'oauth_token' });
  if (isApiKeyAccessible(req)) await auth.protect({ token: 'api_key' });
  if (isMachineTokenAccessible(req)) await auth.protect({ token: 'machine_token' });
  if (isUserAccessible(req)) await auth.protect({ token: 'session_token' });

  if (isAccessibleToAnyValidToken(req)) await auth.protect({ token: 'any' });
});

export const config = {
  matcher: [
    '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)',
    '/(api|trpc)(.*)',
  ],
};

    Leaf node route protection:

    import { auth } from '@&#8203;clerk/nextjs/server';

// In this example, we allow users and oauth tokens with the "profile" scope
// to access the data. Other types of tokens are rejected.
function POST(req, res) {
  const authObject = await auth({ acceptsToken: ['session_token', 'oauth_token'] });

  if (authObject.tokenType === 'oauth_token' && !authObject.scopes?.includes('profile')) {
    throw new Error('Unauthorized: OAuth token missing the "profile" scope');
  }

  // get data from db using userId
  const data = db.select().from(user).where(eq(user.id, authObject.userId));

  return { data };
}

  • The svix dependency is no longer needed when using the verifyWebhook() function. verifyWebhook() was refactored to not rely on svix anymore while keeping the same functionality and behavior. (#​6059) by @​royanger

    If you previously installed svix to use verifyWebhook() you can uninstall it now:

    npm uninstall svix
Patch Changes

v6.20.2

Compare Source

Patch Changes

v6.20.1

Compare Source

Patch Changes

v6.20.0

Compare Source

Minor Changes

  • Introduce treatPendingAsSignedOut option to getAuth and auth from clerkMiddleware (#​5756) by @​LauraBeatris

    By default, treatPendingAsSignedOut is set to true, which means pending sessions are treated as signed-out. You can set this option to false to treat pending sessions as authenticated.

    const { userId } = auth({ treatPendingAsSignedOut: false });
    const { userId } = getAuth(req, { treatPendingAsSignedOut: false });
    <SignedIn treatPendingAsSignedOut={false}>
  User has a session that is either pending (requires tasks resolution) or active
</SignedIn>
Patch Changes

v6.19.5

Compare Source

Patch Changes

v6.19.4

Compare Source

Patch Changes

v6.19.3

Compare Source

Patch Changes

v6.19.2

Compare Source

Patch Changes

v6.19.1

Compare Source

Patch Changes

v6.19.0

Compare Source

Minor Changes

  • Export a new <PricingTable /> component. This component renders plans for user or organizations and upon selection the end-user is prompted with a checkout form. (#​5833) by @​nikosdouvlis

  • Mark commerce apis as stable (#​5833) by @​nikosdouvlis

Patch Changes

v6.18.5

Compare Source

Patch Changes

v6.18.4

Compare Source

Patch Changes

v6.18.3

Compare Source

Patch Changes

v6.18.2

Compare Source

Patch Changes

v6.18.1

Compare Source

Patch Changes

v6.18.0

Compare Source

Minor Changes
Patch Changes

v6.17.0

Compare Source

Minor Changes
useClerk().status

Possible values for useClerk().status are:

  • "loading": Set during initialization
  • "error": Set when hotloading clerk-js failed or Clerk.load() failed
  • "ready": Set when Clerk is fully operational
  • "degraded": Set when Clerk is partially operational
    The computed value of useClerk().loaded is:
  • true when useClerk().status is either "ready" or "degraded".
  • false when useClerk().status is "loading" or "error".
<ClerkFailed />
<ClerkLoaded>
  <MyCustomSignInForm/>
</ClerkLoaded>
<ClerkFailed>
  <ContactSupportBanner/>
</ClerkFailed>
<ClerkDegraded />
<ClerkLoaded>
  <MyCustomPasskeyRegistration />
  <ClerkDegraded>We are experiencing issues, registering a passkey might fail.</ClerkDegraded>
</ClerkLoaded>
Patch Changes

v6.16.0

Compare Source

Minor Changes
  • Adjust the CSP configuration option from mode to boolean strict to make it more intuitive (#​5648) by @​jacekradko
Patch Changes

v6.15.1

Compare Source

Patch Changes

  • Add support for webhook verification with Next.js Pages Router. (#​5618) by @​wobsoriano

    // Next.js Pages Router
import type { NextApiRequest, NextApiResponse } from 'next';
import { verifyWebhook } from '@&#8203;clerk/nextjs/webhooks';

export const config = {
  api: {
    bodyParser: false,
  },
};

export default async function handler(req: NextApiRequest, res: NextApiResponse) {
  try {
    const evt = await verifyWebhook(req);
    // Handle webhook event
    res.status(200).json({ received: true });
  } catch (err) {
    res.status(400).json({ error: 'Webhook verification failed' });
  }
}

// tRPC
import { verifyWebhook } from '@&#8203;clerk/nextjs/webhooks';

const webhookRouter = router({
  webhook: publicProcedure.input(/** schema */).mutation(async ({ ctx }) => {
    const evt = await verifyWebhook(ctx.req);
    // Handle webhook event
    return { received: true };
  }),
});

  • Updated dependencies [ab939fd, 03284da, 7389ba3, 00f16e4, bb35660, efb5d8c, c2712e7, aa93f7f, a7f3ebc, d3fa403, f6ef841, 6cba4e2, fb6aa20, e634830, f8887b2]:

v6.15.0

Compare Source

Minor Changes

v6.14.3

Compare Source

Patch Changes

v6.14.2

Compare Source

Patch Changes

v6.14.1

Compare Source

Patch Changes

v6.14.0

Compare Source

Minor Changes

  • Update useAuth to handle pending sessions as signed-out by default, with opt-out via useAuth({ treatPendingAsSignedOut: false }) or <ClerkProvider treatPendingAsSignedOut={false} /> (#​5507) by @​LauraBeatris

  • import { clerkMiddleware } from '@&#8203;clerk/nextjs/server';

export default clerkMiddleware(async auth => {
  const { userId, redirectToSignUp } = await auth();

  if (!userId) {
    return redirectToSignUp();
  }
});

  • Added Content Security Policy (CSP) header generation functionality to clerkMiddleware with support for both standard and strict-dynamic modes. Key features: (#​5493) by @​jacekradko

    • Automatic generation of CSP headers with default security policies compatible with Clerk requirements
    • Support for both standard and strict-dynamic CSP modes
    • Automatic nonce generation for strict-dynamic mode
    • Ability to add custom directives to match project requirements

    Example

    export default clerkMiddleware(
  async (auth, request) => {
    if (!isPublicRoute(request)) {
      await auth.protect();
    }
  },
  {
    contentSecurityPolicy: {
      mode: "strict-dynamic",
      directives: {
        "connect-src": ["external.api.com"],
        "script-src": ["external.scripts.com"]
      }
    }
  }
);
Patch Changes

v6.13.0

Compare Source

Minor Changes

  • Introduce a verifyWebhook() function to verify incoming Clerk webhook requests and process the payload. This function handles webhook signature verification using Svix and is now available across all backend and fullstack SDKs. (#​5468) by @​wobsoriano

    To get started, install svix, which Clerk uses to verify its webhooks:

    npm install svix

    Then in your webhook route handler, import verifyWebhook() from the Next.js SDK:

    // app/api/webhooks/route.ts
import { verifyWebhook } from '@&#8203;clerk/nextjs/webhooks';

export async function POST(req: Request) {
  try {
    const evt = await verifyWebhook(req);

    // Do something with payload
    const { id } = evt.data;
    const eventType = evt.type;
    console.log(`Received webhook with ID ${id} and event type of ${eventType}`);
    console.log('Webhook payload:', body);

    return new Response('Webhook received', { status: 200 });
  } catch (err) {
    console.error('Error: Could not verify webhook:', err);
    return new Response('Error: Verification error', {
      status: 400,
    });
  }
}

    For more information on how to sync Clerk data to your app with webhooks, see our guide.

  • Redirect to tasks on auth.protect and auth.redirectToSignIn (#​5440) by @​LauraBeatris

Patch Changes

v6.12.12

Compare Source

Patch Changes

v6.12.11

Compare Source

Patch Changes

v6.12.10

Compare Source

Patch Changes

v6.12.9

Compare Source

Patch Changes

  • The majority of Clerk applications are not impacted by the NextJS vulnerability disclosed on 22 MAR 2025. Your application might be impacted if you're not using the latest NextJS release and you do not call auth() in your routes or pages. We still recommend upgrading to the latest NextJS version as soon as possible. (#​5426) by @​nikosdouvlis

    For more details, please see https://clerk.com/blog/cve-2025-29927

v6.12.8

Compare Source

Patch Changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@sonarqubecloud
Copy link

sonarqubecloud bot commented Jul 9, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch 2 times, most recently from ce1fe4a to dcdd2bc Compare August 13, 2025 17:46
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from dcdd2bc to c177d77 Compare August 19, 2025 18:39
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from c177d77 to 0f65653 Compare August 31, 2025 10:20
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 0f65653 to 9930d0c Compare September 25, 2025 15:33
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 9930d0c to 009ec18 Compare October 22, 2025 01:11
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 009ec18 to 56e4f1c Compare November 10, 2025 18:13
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 56e4f1c to 882b0b6 Compare November 18, 2025 20:08
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 882b0b6 to 497bc27 Compare December 3, 2025 16:58
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 497bc27 to 0efa976 Compare December 31, 2025 16:07
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 0efa976 to ccb0316 Compare January 8, 2026 19:59
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch 2 times, most recently from 5f6c171 to a54366a Compare January 23, 2026 17:08
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from a54366a to 6c4ca4e Compare February 2, 2026 18:33
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch 2 times, most recently from 4541f87 to 07d59d9 Compare February 17, 2026 20:28
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 07d59d9 to 296ca2a Compare March 5, 2026 15:07
@renovate renovate bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 296ca2a to 5790c5d Compare March 13, 2026 16:45
@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 13, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants