From f403256d4a77e4f16261c7b9e2d89503380fa992 Mon Sep 17 00:00:00 2001 From: Nikos Douvlis Date: Sat, 22 Mar 2025 22:53:09 +0200 Subject: [PATCH 1/3] fix(nextjs): Update peerDependencies to only allow patched versions For more details, please see https://github.com/advisories/GHSA-f82v-jwr5-mffw --- packages/nextjs/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index a8a9e4c7ddd..68e62ca2d6f 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -103,7 +103,7 @@ "typescript": "*" }, "peerDependencies": { - "next": ">=10", + "next": "^10 || ^13.5.7 || ^14.2.25 || ^15.2.3", "react": "^17.0.2 || ^18.0.0-0", "react-dom": "^17.0.2 || ^18.0.0-0" }, From e6bad19a780a51bb99b9240f8a0e5c832fd6f4eb Mon Sep 17 00:00:00 2001 From: Nikos Douvlis Date: Sun, 23 Mar 2025 00:51:49 +0200 Subject: [PATCH 2/3] Create nasty-apricots-hang.md --- .changeset/nasty-apricots-hang.md | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .changeset/nasty-apricots-hang.md diff --git a/.changeset/nasty-apricots-hang.md b/.changeset/nasty-apricots-hang.md new file mode 100644 index 00000000000..76df1a65984 --- /dev/null +++ b/.changeset/nasty-apricots-hang.md @@ -0,0 +1,6 @@ +--- +"@clerk/nextjs": patch +--- + +We recommend upgrading to the latest NextJS version as soon as possible. +For more details, please see https://github.com/advisories/GHSA-f82v-jwr5-mffw From 3bb1e60e049a0df4a97c56da3ceda67aae2205bc Mon Sep 17 00:00:00 2001 From: Nikos Douvlis Date: Sun, 23 Mar 2025 15:50:02 +0200 Subject: [PATCH 3/3] Update nasty-apricots-hang.md --- .changeset/nasty-apricots-hang.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.changeset/nasty-apricots-hang.md b/.changeset/nasty-apricots-hang.md index 76df1a65984..04f904774a0 100644 --- a/.changeset/nasty-apricots-hang.md +++ b/.changeset/nasty-apricots-hang.md @@ -2,5 +2,6 @@ "@clerk/nextjs": patch --- -We recommend upgrading to the latest NextJS version as soon as possible. +The Vercel team disclosed a NextJS vulnerability on 22 MAR 2025. Your application might be impacted if you're not using the latest NextJS release so we recommend upgrading to the latest NextJS version as soon as possible. + For more details, please see https://github.com/advisories/GHSA-f82v-jwr5-mffw