Skip to content

chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257

Merged
jacekradko merged 3 commits into
mainfrom
renovate/npm-next-vulnerability
Apr 9, 2026
Merged

chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom
renovate/npm-next-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Apr 7, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-29057

Summary

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Impact

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Patches

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

Workarounds

If upgrade is not immediately possible:

  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.

CVE-2026-27980

Summary

The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.

Impact

An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.

Patches

Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.

Workarounds

If upgrade is not immediately possible:

  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)

Release Notes

vercel/next.js (next)

v15.5.13

Compare Source

v15.5.12

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

  • fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits

Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!

Configuration

📅 Schedule: (in timezone GMT)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovaterenovateBot added the dependencies Pull requests that update a dependency file label Apr 7, 2026
@renovate

renovateBot commented Apr 7, 2026•
edited
Loading

Copy link
Copy Markdown
ContributorAuthor

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot

changeset-botBot commented Apr 7, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: b1c679e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Apr 7, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm

Request Review

@pkg-pr-new

pkg-pr-newBot commented Apr 7, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e

@renovate
renovateBotforce-pushed the renovate/npm-next-vulnerability branch from 16f5abb to b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed the renovate/npm-next-vulnerability branch from b534232 to fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed the renovate/npm-next-vulnerability branch from fe66a78 to 6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot changed the title fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed the renovate/npm-next-vulnerability branch from 6e52166 to 4cbb81fCompareApril 8, 2026 21:09
@renovate

renovateBot commented Apr 9, 2026

Copy link
Copy Markdown
ContributorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@jacekradko
jacekradko merged commit e1265b0 into mainApr 9, 2026
70 of 71 checks passed
@jacekradko
jacekradko deleted the renovate/npm-next-vulnerability branch April 9, 2026 01:18
@clerk-cookieclerk-cookie mentioned this pull request Apr 9, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filenextjs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] by renovate[bot] · Pull Request #8257 · clerk/javascript · GitHub
Skip to content
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257
Merged
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Apr 9, 2026
Merged
chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.
Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.
Workarounds
If upgrade is not immediately possible:
  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.
CVE-2026-27980
Summary
The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.
Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.
Workarounds
If upgrade is not immediately possible:
  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Release Notes
vercel/next.js (next)
v15.5.13
Compare Source
v15.5.12
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
  • fix unlock in publish-native
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits
Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 7, 2026
@renovate
renovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
changeset-botBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: b1c679e
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
16f5abb to
b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
b534232 to
fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
fe66a78 to
6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot
changed the title
fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
6e52166 to
4cbb81fCompareApril 8, 2026 21:09
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradko
merged commit e1265b0
into
mainApr 9, 2026

70 of 71 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-next-vulnerability

branch
April 9, 2026 01:18
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filenextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] by renovate[bot] · Pull Request #8257 · clerk/javascript · GitHub
Skip to content
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257
Merged
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Apr 9, 2026
Merged
chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.
Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.
Workarounds
If upgrade is not immediately possible:
  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.
CVE-2026-27980
Summary
The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.
Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.
Workarounds
If upgrade is not immediately possible:
  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Release Notes
vercel/next.js (next)
v15.5.13
Compare Source
v15.5.12
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
  • fix unlock in publish-native
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits
Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 7, 2026
@renovate
renovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
changeset-botBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: b1c679e
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
16f5abb to
b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
b534232 to
fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
fe66a78 to
6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot
changed the title
fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
6e52166 to
4cbb81fCompareApril 8, 2026 21:09
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradko
merged commit e1265b0
into
mainApr 9, 2026

70 of 71 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-next-vulnerability

branch
April 9, 2026 01:18
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filenextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] by renovate[bot] · Pull Request #8257 · clerk/javascript · GitHub
Skip to content
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257
Merged
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Apr 9, 2026
Merged
chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.
Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.
Workarounds
If upgrade is not immediately possible:
  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.
CVE-2026-27980
Summary
The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.
Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.
Workarounds
If upgrade is not immediately possible:
  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Release Notes
vercel/next.js (next)
v15.5.13
Compare Source
v15.5.12
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
  • fix unlock in publish-native
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits
Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 7, 2026
@renovate
renovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
changeset-botBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: b1c679e
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
16f5abb to
b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
b534232 to
fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
fe66a78 to
6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot
changed the title
fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
6e52166 to
4cbb81fCompareApril 8, 2026 21:09
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradko
merged commit e1265b0
into
mainApr 9, 2026

70 of 71 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-next-vulnerability

branch
April 9, 2026 01:18
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filenextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] by renovate[bot] · Pull Request #8257 · clerk/javascript · GitHub
Skip to content
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257
Merged
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Apr 9, 2026
Merged
chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.
Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.
Workarounds
If upgrade is not immediately possible:
  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.
CVE-2026-27980
Summary
The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.
Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.
Workarounds
If upgrade is not immediately possible:
  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Release Notes
vercel/next.js (next)
v15.5.13
Compare Source
v15.5.12
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
  • fix unlock in publish-native
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits
Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 7, 2026
@renovate
renovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
changeset-botBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: b1c679e
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
16f5abb to
b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
b534232 to
fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
fe66a78 to
6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot
changed the title
fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
6e52166 to
4cbb81fCompareApril 8, 2026 21:09
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradko
merged commit e1265b0
into
mainApr 9, 2026

70 of 71 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-next-vulnerability

branch
April 9, 2026 01:18
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filenextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] by renovate[bot] · Pull Request #8257 · clerk/javascript · GitHub
Skip to content
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257
Merged
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Apr 9, 2026
Merged
chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.
Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.
Workarounds
If upgrade is not immediately possible:
  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.
CVE-2026-27980
Summary
The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.
Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.
Workarounds
If upgrade is not immediately possible:
  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Release Notes
vercel/next.js (next)
v15.5.13
Compare Source
v15.5.12
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
  • fix unlock in publish-native
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits
Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 7, 2026
@renovate
renovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
changeset-botBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: b1c679e
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
16f5abb to
b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
b534232 to
fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
fe66a78 to
6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot
changed the title
fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
6e52166 to
4cbb81fCompareApril 8, 2026 21:09
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradko
merged commit e1265b0
into
mainApr 9, 2026

70 of 71 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-next-vulnerability

branch
April 9, 2026 01:18
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filenextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] by renovate[bot] · Pull Request #8257 · clerk/javascript · GitHub
Skip to content
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257
Merged
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Apr 9, 2026
Merged
chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.
Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.
Workarounds
If upgrade is not immediately possible:
  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.
CVE-2026-27980
Summary
The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.
Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.
Workarounds
If upgrade is not immediately possible:
  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Release Notes
vercel/next.js (next)
v15.5.13
Compare Source
v15.5.12
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
  • fix unlock in publish-native
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits
Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 7, 2026
@renovate
renovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
changeset-botBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: b1c679e
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
16f5abb to
b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
b534232 to
fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
fe66a78 to
6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot
changed the title
fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
6e52166 to
4cbb81fCompareApril 8, 2026 21:09
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradko
merged commit e1265b0
into
mainApr 9, 2026

70 of 71 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-next-vulnerability

branch
April 9, 2026 01:18
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filenextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] by renovate[bot] · Pull Request #8257 · clerk/javascript · GitHub
Skip to content
chore(nextjs): Update dependency next to v15.5.13 [SECURITY] - #8257
Merged
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Apr 9, 2026
Merged
chore(nextjs): Update dependency next to v15.5.13 [SECURITY]#8257
jacekradko merged 3 commits into
mainfrom 
renovate/npm-next-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
next (source)15.5.10 → 15.5.13ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.
Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.
Workarounds
If upgrade is not immediately possible:
  • Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
  • Enforce authentication/authorization on backend routes per our security guidance.
CVE-2026-27980
Summary
The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.
Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.
Workarounds
If upgrade is not immediately possible:
  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Release Notes
vercel/next.js (next)
v15.5.13
Compare Source
v15.5.12
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
  • fix unlock in publish-native
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11
Compare Source
[!NOTE]

This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits
Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 7, 2026
@renovate
renovateBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

ContributorAuthor
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml

<--- Last few GCs --->
[909:0x3e2e4000] 90858 ms: Scavenge (interleaved) 1494.8 (1525.5) -> 1494.8 (1530.5) MB, pooled: 0 MB, 61.36 / 0.00 ms (average mu = 0.310, current mu = 0.244) allocation failure; [909:0x3e2e4000] 92547 ms: Mark-Compact (reduce) 1497.8 (1530.5) -> 1497.8 (1527.5) MB, pooled: 0 MB, 888.83 / 0.00 ms (+ 584.0 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 1518 ms) (average mu = 0.298, cu
<--- JS stacktrace --->
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----
1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
4: 0x144d015 [/opt/containerbase/tools/node/22.22.2/bin/node]
5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
8: 0x1414735 v8::internal::Factory::AllocateRawWithAllocationSite(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
9: 0x14219e8 v8::internal::Factory::NewJSObjectFromMap(v8::internal::Handle<v8::internal::Map>, v8::internal::AllocationType, v8::internal::Handle<v8::internal::AllocationSite>) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x157a312 v8::internal::Handle<v8::internal::Object> v8::internal::JSDataObjectBuilder::BuildFromIterator<v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&>(v8::internal::JsonParser<unsigned char>::NamedPropertyIterator&, v8::internal::MaybeHandle<v8::internal::FixedArrayBase>) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x157ba4f v8::internal::JsonParser<unsigned char>::BuildJsonObject(v8::internal::JsonParser<unsigned char>::JsonContinuation const&, v8::base::SmallVector<v8::internal::JsonProperty, 16ul, std::allocator<v8::internal::JsonProperty> > const&, v8::internal::Handle<v8::internal::Map>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f674 [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36 [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18: 909 Aborted /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
changeset-botBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: b1c679e
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/nextjsPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 8, 2026 9:45pm
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 7, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8257

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8257

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8257

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8257

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8257

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8257

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8257

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8257

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8257

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8257

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8257

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8257

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8257

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8257

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8257

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8257

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8257

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8257

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8257

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8257

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8257

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8257

commit: b1c679e
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
16f5abb to
b534232CompareApril 7, 2026 14:56
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
b534232 to
fe66a78CompareApril 7, 2026 15:24
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
fe66a78 to
6e52166CompareApril 8, 2026 20:17
@renovaterenovateBot
changed the title
fix(repo): Update dependency next [SECURITY]chore(nextjs): Update dependency next to v15.5.13 [SECURITY]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-next-vulnerability
branch
from
6e52166 to
4cbb81fCompareApril 8, 2026 21:09
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradko
merged commit e1265b0
into
mainApr 9, 2026

70 of 71 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-next-vulnerability

branch
April 9, 2026 01:18
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency filenextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko