chore(nextjs): Bump nextjs version for CVE-2025-55182 #7423
Conversation
🦋 Changeset detectedLatest commit: 429107b The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughBumped Next.js from 15.2.3 to 15.2.6 in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
| @@ -0,0 +1,5 @@ | |||
| --- | |||
| '@clerk/nextjs': patch | |||
There was a problem hiding this comment.
I wasn't sure if this was a patch or minor?
There was a problem hiding this comment.
In this case its a patch as Core 3 already has a major release planned (so its going to go out as a major either way)
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.changeset/fuzzy-geese-guess.md (1)
1-5: Changeset format is correct; consider enhancing the description for clarity.The changeset follows the correct format with proper YAML frontmatter and a patch-level bump designation. However, the description is minimal and could be more informative for release notes and consumers of this package.
Consider expanding the description to specify the Next.js version bump details and the nature of the CVE fix:
--- '@clerk/nextjs': patch --- -Updating peerDependency for CVE-2025-55182 +Bump Next.js to 15.2.6 to address CVE-2025-55182 (react2shell vulnerability)This provides clearer context for users reviewing release notes.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.changeset/fuzzy-geese-guess.md(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (26)
- GitHub Check: Integration Tests (quickstart, chrome, 16)
- GitHub Check: Integration Tests (quickstart, chrome, 15)
- GitHub Check: Integration Tests (nextjs, chrome, 16)
- GitHub Check: Integration Tests (nextjs, chrome, 16, RQ)
- GitHub Check: Integration Tests (machine, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (custom, chrome)
- GitHub Check: Integration Tests (machine, chrome, RQ)
- GitHub Check: Integration Tests (billing, chrome, RQ)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (handshake:staging, chrome)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (sessions:staging, chrome)
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (handshake, chrome)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Build Packages
- GitHub Check: Formatting | Dedupe | Changeset
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (1)
.changeset/fuzzy-geese-guess.md (1)
2-2: Package.json changes are correctly aligned with the changeset.The Next.js versions in packages/nextjs/package.json have been properly updated to address CVE-2025-55182: devDependencies specifies
15.2.6and peerDependencies allows^15.2.6 || ^16. The versions are consistent across both dependency types, supporting the patch-level bump documented in the changeset.
| @@ -0,0 +1,5 @@ | |||
| --- | |||
| '@clerk/nextjs': patch | |||
There was a problem hiding this comment.
In this case its a patch as Core 3 already has a major release planned (so its going to go out as a major either way)
|
This PR focused on the next version we had as a devDependency but to be more rigorous with the version ranges we'd probably need to go with diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
index 9098b8f69..96b233367 100644
--- a/packages/nextjs/package.json
+++ b/packages/nextjs/package.json
@@ -95,7 +95,7 @@
"next": "15.2.6"
},
"peerDependencies": {
- "next": "^15.2.6 || ^16",
+ "next": "^15.2.6 || ^15.3.6 || ^15.4.8 || ^15.5.7 || ^15.6.0-0 || ^16.0.7 || ^16.1.0-0",
"react": "catalog:peer-react",
"react-dom": "catalog:peer-react"
},
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 7c7484abc..124daef63 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -3,7 +3,7 @@ packages:
catalogs:
peer-react:
- react: ^18.0.0 || ^19.0.0 || ^19.0.0-0
+ react: ^18.0.0 || ^19.0.1 || ^19.1.2 || ^19.2.1 || ^19.0.1-0
react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-0
react:
'@types/react': 18.3.26WDYT @nikosdouvlis ? Or maybe I'm getting carried away here 😅 |
| "next": "15.2.6" | ||
| }, | ||
| "peerDependencies": { | ||
| "next": "^15.2.3 || ^16", | ||
| "next": "^15.2.6 || ^16", |
There was a problem hiding this comment.
We should likely update this to cover the new set of CVEs too while we are at it?
Description
As a react2shell follow-up, this upgrades the dev version and also the peer dependency so clerk installations aren't vulnerable to react2shell.
See also
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
Chores
Security
✏️ Tip: You can customize this high-level summary in your review settings.