From 357b6f2d4caa762d0a1b52c6481cc956e1f5c41f Mon Sep 17 00:00:00 2001 From: Dominic Couture Date: Wed, 10 Dec 2025 12:05:29 +0000 Subject: [PATCH 1/5] chore(nextjs): Bump nextjs version for CVE-2025-55182 --- packages/nextjs/package.json | 4 +- pnpm-lock.yaml | 82 ++++++++++++++++++------------------ 2 files changed, 43 insertions(+), 43 deletions(-) diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index 7ca90a77d47..9098b8f69fe 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -92,10 +92,10 @@ }, "devDependencies": { "crypto-es": "^2.1.0", - "next": "15.2.3" + "next": "15.2.6" }, "peerDependencies": { - "next": "^15.2.3 || ^16", + "next": "^15.2.6 || ^16", "react": "catalog:peer-react", "react-dom": "catalog:peer-react" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4bbb3ed5f9a..d093848f2a7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -685,8 +685,8 @@ importers: specifier: ^2.1.0 version: 2.1.0 next: - specifier: 15.2.3 - version: 15.2.3(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: 15.2.6 + version: 15.2.6(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) packages/nuxt: dependencies: @@ -3214,57 +3214,57 @@ packages: '@napi-rs/wasm-runtime@1.0.7': resolution: {integrity: sha512-SeDnOO0Tk7Okiq6DbXmmBODgOAb9dp9gjlphokTUxmt8U3liIP1ZsozBahH69j/RJv+Rfs6IwUKHTgQYJ/HBAw==} - '@next/env@15.2.3': - resolution: {integrity: sha512-a26KnbW9DFEUsSxAxKBORR/uD9THoYoKbkpFywMN/AFvboTt94b8+g/07T8J6ACsdLag8/PDU60ov4rPxRAixw==} + '@next/env@15.2.6': + resolution: {integrity: sha512-kp1Mpm4K1IzSSJ5ZALfek0JBD2jBw9VGMXR/aT7ykcA2q/ieDARyBzg+e8J1TkeIb5AFj/YjtZdoajdy5uNy6w==} - '@next/swc-darwin-arm64@15.2.3': - resolution: {integrity: sha512-uaBhA8aLbXLqwjnsHSkxs353WrRgQgiFjduDpc7YXEU0B54IKx3vU+cxQlYwPCyC8uYEEX7THhtQQsfHnvv8dw==} + '@next/swc-darwin-arm64@15.2.5': + resolution: {integrity: sha512-4OimvVlFTbgzPdA0kh8A1ih6FN9pQkL4nPXGqemEYgk+e7eQhsst/p35siNNqA49eQA6bvKZ1ASsDtu9gtXuog==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.2.3': - resolution: {integrity: sha512-pVwKvJ4Zk7h+4hwhqOUuMx7Ib02u3gDX3HXPKIShBi9JlYllI0nU6TWLbPT94dt7FSi6mSBhfc2JrHViwqbOdw==} + '@next/swc-darwin-x64@15.2.5': + resolution: {integrity: sha512-ohzRaE9YbGt1ctE0um+UGYIDkkOxHV44kEcHzLqQigoRLaiMtZzGrA11AJh2Lu0lv51XeiY1ZkUvkThjkVNBMA==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.2.3': - resolution: {integrity: sha512-50ibWdn2RuFFkOEUmo9NCcQbbV9ViQOrUfG48zHBCONciHjaUKtHcYFiCwBVuzD08fzvzkWuuZkd4AqbvKO7UQ==} + '@next/swc-linux-arm64-gnu@15.2.5': + resolution: {integrity: sha512-FMSdxSUt5bVXqqOoZCc/Seg4LQep9w/fXTazr/EkpXW2Eu4IFI9FD7zBDlID8TJIybmvKk7mhd9s+2XWxz4flA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [glibc] - '@next/swc-linux-arm64-musl@15.2.3': - resolution: {integrity: sha512-2gAPA7P652D3HzR4cLyAuVYwYqjG0mt/3pHSWTCyKZq/N/dJcUAEoNQMyUmwTZWCJRKofB+JPuDVP2aD8w2J6Q==} + '@next/swc-linux-arm64-musl@15.2.5': + resolution: {integrity: sha512-4ZNKmuEiW5hRKkGp2HWwZ+JrvK4DQLgf8YDaqtZyn7NYdl0cHfatvlnLFSWUayx9yFAUagIgRGRk8pFxS8Qniw==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [musl] - '@next/swc-linux-x64-gnu@15.2.3': - resolution: {integrity: sha512-ODSKvrdMgAJOVU4qElflYy1KSZRM3M45JVbeZu42TINCMG3anp7YCBn80RkISV6bhzKwcUqLBAmOiWkaGtBA9w==} + '@next/swc-linux-x64-gnu@15.2.5': + resolution: {integrity: sha512-bE6lHQ9GXIf3gCDE53u2pTl99RPZW5V1GLHSRMJ5l/oB/MT+cohu9uwnCK7QUph2xIOu2a6+27kL0REa/kqwZw==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [glibc] - '@next/swc-linux-x64-musl@15.2.3': - resolution: {integrity: sha512-ZR9kLwCWrlYxwEoytqPi1jhPd1TlsSJWAc+H/CJHmHkf2nD92MQpSRIURR1iNgA/kuFSdxB8xIPt4p/T78kwsg==} + '@next/swc-linux-x64-musl@15.2.5': + resolution: {integrity: sha512-y7EeQuSkQbTAkCEQnJXm1asRUuGSWAchGJ3c+Qtxh8LVjXleZast8Mn/rL7tZOm7o35QeIpIcid6ufG7EVTTcA==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [musl] - '@next/swc-win32-arm64-msvc@15.2.3': - resolution: {integrity: sha512-+G2FrDcfm2YDbhDiObDU/qPriWeiz/9cRR0yMWJeTLGGX6/x8oryO3tt7HhodA1vZ8r2ddJPCjtLcpaVl7TE2Q==} + '@next/swc-win32-arm64-msvc@15.2.5': + resolution: {integrity: sha512-gQMz0yA8/dskZM2Xyiq2FRShxSrsJNha40Ob/M2n2+JGRrZ0JwTVjLdvtN6vCxuq4ByhOd4a9qEf60hApNR2gQ==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.2.3': - resolution: {integrity: sha512-gHYS9tc+G2W0ZC8rBL+H6RdtXIyk40uLiaos0yj5US85FNhbFEndMA2nW3z47nzOWiSvXTZ5kBClc3rD0zJg0w==} + '@next/swc-win32-x64-msvc@15.2.5': + resolution: {integrity: sha512-tBDNVUcI7U03+3oMvJ11zrtVin5p0NctiuKmTGyaTIEAVj9Q77xukLXGXRnWxKRIIdFG4OTA2rUVGZDYOwgmAA==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -10737,8 +10737,8 @@ packages: nested-error-stacks@2.1.1: resolution: {integrity: sha512-9iN1ka/9zmX1ZvLV9ewJYEk9h7RyRRtqdK0woXcqohu8EWIerfPUjYJPg0ULy0UqP7cslmdGc8xKDJcojlKiaw==} - next@15.2.3: - resolution: {integrity: sha512-x6eDkZxk2rPpu46E1ZVUWIBhYCLszmUY6fvHBFcbzJ9dD+qRX6vcHusaqqDlnY+VngKzKbAiG2iRCkPbmi8f7w==} + next@15.2.6: + resolution: {integrity: sha512-DIKFctUpZoCq5ok2ztVU+PqhWsbiqM9xNP7rHL2cAp29NQcmDp7Y6JnBBhHRbFt4bCsCZigj6uh+/Gwh2158Wg==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -17694,30 +17694,30 @@ snapshots: '@tybys/wasm-util': 0.10.1 optional: true - '@next/env@15.2.3': {} + '@next/env@15.2.6': {} - '@next/swc-darwin-arm64@15.2.3': + '@next/swc-darwin-arm64@15.2.5': optional: true - '@next/swc-darwin-x64@15.2.3': + '@next/swc-darwin-x64@15.2.5': optional: true - '@next/swc-linux-arm64-gnu@15.2.3': + '@next/swc-linux-arm64-gnu@15.2.5': optional: true - '@next/swc-linux-arm64-musl@15.2.3': + '@next/swc-linux-arm64-musl@15.2.5': optional: true - '@next/swc-linux-x64-gnu@15.2.3': + '@next/swc-linux-x64-gnu@15.2.5': optional: true - '@next/swc-linux-x64-musl@15.2.3': + '@next/swc-linux-x64-musl@15.2.5': optional: true - '@next/swc-win32-arm64-msvc@15.2.3': + '@next/swc-win32-arm64-msvc@15.2.5': optional: true - '@next/swc-win32-x64-msvc@15.2.3': + '@next/swc-win32-x64-msvc@15.2.5': optional: true '@nicolo-ribaudo/chokidar-2@2.1.8-no-fsevents.3': @@ -27074,9 +27074,9 @@ snapshots: nested-error-stacks@2.1.1: {} - next@15.2.3(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + next@15.2.6(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: - '@next/env': 15.2.3 + '@next/env': 15.2.6 '@swc/counter': 0.1.3 '@swc/helpers': 0.5.15 busboy: 1.6.0 @@ -27086,14 +27086,14 @@ snapshots: react-dom: 18.3.1(react@18.3.1) styled-jsx: 5.1.6(@babel/core@7.28.5)(babel-plugin-macros@3.1.0)(react@18.3.1) optionalDependencies: - '@next/swc-darwin-arm64': 15.2.3 - '@next/swc-darwin-x64': 15.2.3 - '@next/swc-linux-arm64-gnu': 15.2.3 - '@next/swc-linux-arm64-musl': 15.2.3 - '@next/swc-linux-x64-gnu': 15.2.3 - '@next/swc-linux-x64-musl': 15.2.3 - '@next/swc-win32-arm64-msvc': 15.2.3 - '@next/swc-win32-x64-msvc': 15.2.3 + '@next/swc-darwin-arm64': 15.2.5 + '@next/swc-darwin-x64': 15.2.5 + '@next/swc-linux-arm64-gnu': 15.2.5 + '@next/swc-linux-arm64-musl': 15.2.5 + '@next/swc-linux-x64-gnu': 15.2.5 + '@next/swc-linux-x64-musl': 15.2.5 + '@next/swc-win32-arm64-msvc': 15.2.5 + '@next/swc-win32-x64-msvc': 15.2.5 '@opentelemetry/api': 1.9.0 '@playwright/test': 1.56.1 babel-plugin-react-compiler: 1.0.0 From f4bcfc320add7b9eee7c4233a371a81e64532868 Mon Sep 17 00:00:00 2001 From: Dominic Couture Date: Wed, 10 Dec 2025 12:11:02 +0000 Subject: [PATCH 2/5] Add changeset file --- .changeset/fuzzy-geese-guess.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/fuzzy-geese-guess.md diff --git a/.changeset/fuzzy-geese-guess.md b/.changeset/fuzzy-geese-guess.md new file mode 100644 index 00000000000..23c3af5cec1 --- /dev/null +++ b/.changeset/fuzzy-geese-guess.md @@ -0,0 +1,5 @@ +--- +'@clerk/nextjs': patch +--- + +Updating peerDependency for CVE-2025-55182 From 6c219c29e195662210c0f9027be7454516646a00 Mon Sep 17 00:00:00 2001 From: Dominic Couture Date: Mon, 15 Dec 2025 10:07:32 +0000 Subject: [PATCH 3/5] Expand versions to cover all releases --- packages/nextjs/package.json | 2 +- pnpm-workspace.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index 9098b8f69fe..96b2333672f 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -95,7 +95,7 @@ "next": "15.2.6" }, "peerDependencies": { - "next": "^15.2.6 || ^16", + "next": "^15.2.6 || ^15.3.6 || ^15.4.8 || ^15.5.7 || ^15.6.0-0 || ^16.0.7 || ^16.1.0-0", "react": "catalog:peer-react", "react-dom": "catalog:peer-react" }, diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 7c7484abc32..124daef6310 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -3,7 +3,7 @@ packages: catalogs: peer-react: - react: ^18.0.0 || ^19.0.0 || ^19.0.0-0 + react: ^18.0.0 || ^19.0.1 || ^19.1.2 || ^19.2.1 || ^19.0.1-0 react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-0 react: '@types/react': 18.3.26 From 0106fccbb74d34ab75dfde7da437cc6484b1ebdd Mon Sep 17 00:00:00 2001 From: Dominic Couture Date: Mon, 15 Dec 2025 10:11:42 +0000 Subject: [PATCH 4/5] Cover new RSC CVEs --- packages/nextjs/package.json | 4 ++-- pnpm-lock.yaml | 18 +++++++++--------- pnpm-workspace.yaml | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index 96b2333672f..3a73a657aba 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -92,10 +92,10 @@ }, "devDependencies": { "crypto-es": "^2.1.0", - "next": "15.2.6" + "next": "15.2.8" }, "peerDependencies": { - "next": "^15.2.6 || ^15.3.6 || ^15.4.8 || ^15.5.7 || ^15.6.0-0 || ^16.0.7 || ^16.1.0-0", + "next": "^15.2.8 || ^15.3.8 || ^15.4.10 || ^15.5.9 || ^15.6.0-0 || ^16.0.10 || ^16.1.0-0", "react": "catalog:peer-react", "react-dom": "catalog:peer-react" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d093848f2a7..6aa09a9ca52 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -685,8 +685,8 @@ importers: specifier: ^2.1.0 version: 2.1.0 next: - specifier: 15.2.6 - version: 15.2.6(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: 15.2.8 + version: 15.2.8(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) packages/nuxt: dependencies: @@ -3214,8 +3214,8 @@ packages: '@napi-rs/wasm-runtime@1.0.7': resolution: {integrity: sha512-SeDnOO0Tk7Okiq6DbXmmBODgOAb9dp9gjlphokTUxmt8U3liIP1ZsozBahH69j/RJv+Rfs6IwUKHTgQYJ/HBAw==} - '@next/env@15.2.6': - resolution: {integrity: sha512-kp1Mpm4K1IzSSJ5ZALfek0JBD2jBw9VGMXR/aT7ykcA2q/ieDARyBzg+e8J1TkeIb5AFj/YjtZdoajdy5uNy6w==} + '@next/env@15.2.8': + resolution: {integrity: sha512-TaEsAki14R7BlgywA05t2PFYfwZiNlGUHyIQHVyloXX3y+Dm0HUITe5YwTkjtuOQuDhuuLotNEad4VtnmE11Uw==} '@next/swc-darwin-arm64@15.2.5': resolution: {integrity: sha512-4OimvVlFTbgzPdA0kh8A1ih6FN9pQkL4nPXGqemEYgk+e7eQhsst/p35siNNqA49eQA6bvKZ1ASsDtu9gtXuog==} @@ -10737,8 +10737,8 @@ packages: nested-error-stacks@2.1.1: resolution: {integrity: sha512-9iN1ka/9zmX1ZvLV9ewJYEk9h7RyRRtqdK0woXcqohu8EWIerfPUjYJPg0ULy0UqP7cslmdGc8xKDJcojlKiaw==} - next@15.2.6: - resolution: {integrity: sha512-DIKFctUpZoCq5ok2ztVU+PqhWsbiqM9xNP7rHL2cAp29NQcmDp7Y6JnBBhHRbFt4bCsCZigj6uh+/Gwh2158Wg==} + next@15.2.8: + resolution: {integrity: sha512-pe2trLKZTdaCuvNER0S9Wp+SP2APf7SfFmyUP9/w1SFA2UqmW0u+IsxCKkiky3n6um7mryaQIlgiDnKrf1ZwIw==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -17694,7 +17694,7 @@ snapshots: '@tybys/wasm-util': 0.10.1 optional: true - '@next/env@15.2.6': {} + '@next/env@15.2.8': {} '@next/swc-darwin-arm64@15.2.5': optional: true @@ -27074,9 +27074,9 @@ snapshots: nested-error-stacks@2.1.1: {} - next@15.2.6(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + next@15.2.8(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: - '@next/env': 15.2.6 + '@next/env': 15.2.8 '@swc/counter': 0.1.3 '@swc/helpers': 0.5.15 busboy: 1.6.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 124daef6310..7ca576f0803 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -3,7 +3,7 @@ packages: catalogs: peer-react: - react: ^18.0.0 || ^19.0.1 || ^19.1.2 || ^19.2.1 || ^19.0.1-0 + react: ^18.0.0 || ^19.0.3 || ^19.1.4 || ^19.2.3 || ^19.3.0-0 react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-0 react: '@types/react': 18.3.26 From f71deff7f62eb6d1c2c944a07eb29c6115edc3d0 Mon Sep 17 00:00:00 2001 From: Dominic Date: Mon, 15 Dec 2025 10:53:15 +0000 Subject: [PATCH 5/5] Update pnpm-workspace.yaml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- pnpm-workspace.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 7ca576f0803..2e4bd689bfc 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -4,7 +4,7 @@ packages: catalogs: peer-react: react: ^18.0.0 || ^19.0.3 || ^19.1.4 || ^19.2.3 || ^19.3.0-0 - react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-0 + react-dom: ^18.0.0 || ^19.0.3 || ^19.1.4 || ^19.2.3 || ^19.3.0-0 react: '@types/react': 18.3.26 '@types/react-dom': 18.3.7