fix(init): scaffold bare clerkMiddleware instead of deprecated createRouteMatcher by rafa-thayto · Pull Request #387 · clerk/cli

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

rafa-thayto · 2026-07-16T17:32:05Z

Summary

clerk init was scaffolding Next.js middleware with createRouteMatcher-based route protection, which Clerk has deprecated in favor of protecting each server-side resource individually with await auth.protect().

clerk init for Next.js (App Router and Pages Router) now generates bare export default clerkMiddleware() with the standard config matcher — no isPublicRoute / createRouteMatcher / auth.protect() block
i18n composition (next-intl et al.) and existing-middleware composition still wrap the user's middleware inside clerkMiddleware(); they just no longer inject the route matcher
The keyless "permissive middleware" variant collapsed into the default (both are now identical), so the ctx.keyless scaffold plumbing was removed
New post-init instruction tells users routes are public by default and how to protect resources (auth.protect() for App Router, getAuth() for Pages Router)
clerk webhooks listen 401 diagnostic no longer recommends createRouteMatcher(['/api/webhooks(.*)']); it now says to remove auth.protect() for the webhook route
Changeset included (clerk: patch)

Test plan

bun run format / lint / typecheck pass
Full unit/integration suite: 1903 pass, 0 fail
Ran real clerk init --keyless -y against 8 sandboxed projects: fresh App Router (next 15 → middleware.ts), Next 16 (→ proxy.ts), Pages Router, fresh next-intl project, existing next-intl expression middleware with own config, user-composed i18n function middleware, i18n middleware with taken varName, and existing plain custom middleware — zero createRouteMatcher occurrences in any generated file, compositions correct
Generated bare and i18n-composed middleware typecheck against the real published @clerk/nextjs
Idempotency: re-running init on a scaffolded project reports "No files to scaffold" and leaves middleware unchanged

…RouteMatcher Clerk deprecated middleware-level route protection via createRouteMatcher in favor of protecting each server-side resource individually with `await auth.protect()`. `clerk init` for Next.js now generates `export default clerkMiddleware()` (i18n and existing-middleware compositions keep wrapping, minus the route matcher), prints a post-init instruction pointing to resource-level protection, and the `webhooks listen` 401 hint no longer recommends createRouteMatcher. Removes the now-collapsed keyless middleware variant plumbing. https://clerk.com/docs/guides/development/upgrading/upgrade-guides/migrate-from-create-route-matcher

changeset-bot · 2026-07-16T17:32:13Z

🦋 Changeset detected

Latest commit: 4465797

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
clerk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-16T17:36:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 322b8793-1778-4bb2-aea9-5dcfe0f2ec52

📥 Commits

Reviewing files that changed from the base of the PR and between 19c0b58 and 4465797.

📒 Files selected for processing (12)

.changeset/init-remove-create-route-matcher.md
packages/cli-core/src/commands/init/README.md
packages/cli-core/src/commands/init/frameworks/helpers.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-app.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.test.ts
packages/cli-core/src/commands/init/frameworks/nextjs-pages.ts
packages/cli-core/src/commands/init/frameworks/types.ts
packages/cli-core/src/commands/init/index.test.ts
packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/webhooks/render.test.ts
packages/cli-core/src/commands/webhooks/render.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go(manual)
clerk/dashboard(manual)
clerk/accounts(manual)
clerk/backoffice(manual)
clerk/clerk(manual)
clerk/clerk-docs(manual)
clerk/cloudflare-workers(manual)

💤 Files with no reviewable changes (2)

packages/cli-core/src/commands/init/index.ts
packages/cli-core/src/commands/init/frameworks/types.ts

📝 Walkthrough

Walkthrough

Next.js initialization now generates bare clerkMiddleware() without createRouteMatcher route protection. App Router and Pages Router scaffolds add instructions to protect pages, API routes, route handlers, and server actions individually with auth.protect() or getAuth(). Middleware context and composition APIs were updated accordingly, tests and documentation reflect the new output, and webhook diagnostics now reference resource-level protection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: scaffolding bare clerkMiddleware instead of deprecated createRouteMatcher logic.
Description check	✅ Passed	The description is directly about the Next.js init scaffolding, middleware composition, guidance, and webhook diagnostic changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

wyattjoh approved these changes Jul 16, 2026
View reviewed changes

rafa-thayto merged commit c2577ab into mainJul 21, 2026
10 checks passed

rafa-thayto deleted the rafa-thayto/init-remove-create-route-matcher branch July 21, 2026 20:20