Update dependency @supabase/ssr to ^0.12.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@supabase/ssr	^0.6.1 → ^0.12.0

---

Release Notes

supabase/ssr (@​supabase/ssr)

v0.12.4

Compare Source

Bug Fixes

• flush PKCE verifier slot removals on the server (#​275) (6df6f03)

v0.12.3

Compare Source

Bug Fixes

• cookies: keep domain-scoped deletion in name-keyed cookie stores (#​258) (d3a8a98), closes #​256

v0.12.2

Compare Source

Bug Fixes

• align parseCookieHeader return type with getAll cookie method (#​239) (e8fe1d5), closes #​115

v0.12.1

Compare Source

Bug Fixes

• cookies: deduplicate server cookie writes (#​246) (035eabe)

v0.12.0

Compare Source

Features

• adds cookies.encode option allowing minimal cookie sizes (#​126) (cf38b22)
• bump cookie to 1.0.2 (#​113) (b4a77b4)
• cookies: add clearAuthCookiesAtScopes migration helper (#​240) (4e47249)
• full rewrite using getAll and setAll cookie methods (#​1) (b6ae192)
• improve cookie chunk handling via base64url+length encoding (#​90) (6deb687)
• pass cache headers to setAll to prevent CDN caching of auth responses (#​176) (14962d2)
• publish SSR under deprecated auth-helpers package names (#​127) (e8b6102)
• release workflow RC versioning and publish reliability (#​164) (81e68f4)
• update CI so it runs on release as well (#​33) (4517996)
• update supabase-js to latest (#​133) (d65044d)
• update supabase-js to latest (#​145) (08bf7d6)
• upgrade cookie dependency and cleanup imports (#​77) (9524528)

Bug Fixes

• add @​types/cookies to dependencies (#​63) (47e5f16)
• add create*Client string in x-client-info (#​85) (f271acc)
• allow cookies encode without getAll/setAll on browser client (#​213) (89f3f28), closes #​170
• allow use of createBrowserClient without window present (#​20) (27d868d)
• auth: respect user-provided auth options in createBrowserClient (#​167) (5f04837)
• check chunkedCookie is string in server client (#​57) (549fe62)
• ci: remove packageManager field (#​197) (6bf0226)
• cookies console warnings (#​136) (64ff6b3)
• deprecate parse, serialize exports for more useful functions (#​14) (0b5f881)
• enable tree-shaking for browser bundles (#​216) (f009d71)
• fix createBrowserClient deprecation tsdoc (#​17) (1df70ad)
• force release (#​98) (66710e8)
• re-apply update CI so it runs on release as well (#​49) (51d5a43)
• release: pin npm to 11.5.2 so OIDC trusted publisher works (#​249) (4af89f7)
• remove optional dependencies (#​41) (a48fe6f)
• remove usage of internal type params (#​123) (8f3e89e)
• revert "update CI so it runs on release as well" (#​44) (9d0e859)
• revert: "feat: improve cookie chunk handling via base64url+length encoding (#​90)" (#​100) (2ea8e23)
• set max-age default cookie option to 400 days (#​54) (f4ed2e0)
• set cookies for password recovery event (#​32) (7dc1837)
• set cookies when mfa challenge is verified (#​27) (c217f53)
• tsconfig: set explicit rootDir to silence TS6059 in consumer IDEs (#​211) (a77ee8a), closes #​209
• update conventional commits ci to use main instead of master (#​31) (bebce89)
• update README session docs (#​159) (b859905)
• update type, remove unused imports, define AuthEvent type (#​47) (4f4a375)
• use skipAutoInitialize to prevent SSR token refresh race condition (#​131) (0b7be28)
• validate base64-prefixed chunked cookies decode to valid JSON (#​210) (302cc0e)

v0.10.3

Compare Source

Bug Fixes

• allow cookies encode without getAll/setAll on browser client (#​213) (89f3f28), closes #​170
• enable tree-shaking for browser bundles (#​216) (f009d71)
• tsconfig: set explicit rootDir to silence TS6059 in consumer IDEs (#​211) (a77ee8a), closes #​209
• validate base64-prefixed chunked cookies decode to valid JSON (#​210) (302cc0e)

v0.10.2

Compare Source

Bug Fixes

• ci: remove packageManager field (#​197) (6bf0226)

v0.10.0

Compare Source

Features

• pass cache headers to setAll to prevent CDN caching of auth responses (#​176) (14962d2)

v0.9.0

Compare Source

Features

• release workflow RC versioning and publish reliability (#​164) (81e68f4)

v0.8.0

Compare Source

Features

• adds cookies.encode option allowing minimal cookie sizes (#​126) (cf38b22)
• publish SSR under deprecated auth-helpers package names (#​127) (e8b6102)
• update supabase-js to latest (#​133) (d65044d)
• update supabase-js to latest (#​145) (08bf7d6)

Bug Fixes

• cookies console warnings (#​136) (64ff6b3)

v0.7.0

Compare Source

Features

• bump cookie to 1.0.2 (#​113) (b4a77b4)

Bug Fixes

• remove usage of internal type params (#​123) (8f3e89e)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

This change is 

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
bclabs	Error		Jul 28, 2026 4:35pm

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openzeppelin-code]

Update dependency @supabase/ssr to ^0.9.0

Generated at commit: 4eb35cf94ca9d8295b8fc1d4e2a4bc10ccc90f0b

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	0 0 0 0 0 0
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

---

For more details view the full report in OpenZeppelin Code Inspector

[sentry]

Bug: There is a significant peer dependency mismatch. @supabase/ssr@0.9.0 requires @supabase/supabase-js@^2.97.0, but version 2.49.4 is installed, which may cause runtime compatibility issues.
_{Severity: MEDIUM}

Suggested Fix

Update the @supabase/supabase-js dependency to a version that satisfies the ^2.97.0 requirement of @supabase/ssr. Run bun install @supabase/supabase-js@latest (or a specific compatible version) and verify that the application's authentication flows continue to work as expected after the update.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L42-L43

Potential issue: The project has a peer dependency mismatch. The `@supabase/ssr` package
at version `0.9.0` requires `@supabase/supabase-js` version `^2.97.0`, but the installed
version is `2.49.4`. This significant version gap (over 48 minor versions) creates a
risk of incompatibility, especially since the code uses core authentication functions
like `createServerClient` and `auth.exchangeCodeForSession()`. While this might only
produce a warning during installation, it could lead to runtime errors if the APIs used
by `@supabase/ssr` rely on features or behavior from the newer, required version of
`@supabase/supabase-js`.

_{Did we get this right? 👍 / 👎 to inform future reviews.}