Skip to content

build(deps): bump @clerk/nextjs from 7.9.2 to 7.9.12 - #404

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/clerk/nextjs-7.9.12
Closed

build(deps): bump @clerk/nextjs from 7.9.2 to 7.9.12#404
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/clerk/nextjs-7.9.12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps @clerk/nextjs from 7.9.2 to 7.9.12.

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.9.12

Patch Changes

@​clerk/nextjs@​7.9.11

Patch Changes

  • Remove https://images.clerkstage.dev from the default connect-src Content Security Policy directive. It is a Clerk-internal storage host that no application connects to. Organization logos are served from https://img.clerk.com, which stays in the default. (#9898) by @​Grundlefleck

  • Updated dependencies [2302140, 2654caa, dee649c]:

    • @​clerk/backend@​3.23.0
    • @​clerk/shared@​4.39.0
    • @​clerk/react@​6.17.6

@​clerk/nextjs@​7.9.9

Patch Changes

  • Removed the period from the end of the displayed error. Agents were trying to use the URL with period at the end and getting 404s (#9985) by @​royanger

  • Updated dependencies [0fe89c2, e34a5cc, c8eb8d5]:

    • @​clerk/backend@​3.21.1
    • @​clerk/shared@​4.37.1
    • @​clerk/react@​6.17.4

@​clerk/nextjs@​7.9.7

Patch Changes

Changelog

Sourced from @​clerk/nextjs's changelog.

7.9.12

Patch Changes

7.9.11

Patch Changes

  • Remove https://images.clerkstage.dev from the default connect-src Content Security Policy directive. It is a Clerk-internal storage host that no application connects to. Organization logos are served from https://img.clerk.com, which stays in the default. (#9898) by @​Grundlefleck

  • Updated dependencies [2302140, 2654caa, dee649c]:

    • @​clerk/backend@​3.23.0
    • @​clerk/shared@​4.39.0
    • @​clerk/react@​6.17.6

7.9.10

Patch Changes

7.9.9

Patch Changes

  • Removed the period from the end of the displayed error. Agents were trying to use the URL with period at the end and getting 404s (#9985) by @​royanger

  • Updated dependencies [0fe89c2, e34a5cc, c8eb8d5]:

    • @​clerk/backend@​3.21.1
    • @​clerk/shared@​4.37.1
    • @​clerk/react@​6.17.4

7.9.8

Patch Changes

7.9.7

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

  • Maintenance
    • Updated the app’s underlying platform integration. No changes to user-facing features or behavior are included in this update.

@dependabot
build(deps): bump @clerk/nextjs from 7.9.2 to 7.9.12
e8c6842 
Bumps [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) from 7.9.2 to 7.9.12.
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.9.12/packages/nextjs)

---
updated-dependencies:
- dependency-name: "@clerk/nextjs"
  dependency-version: 7.9.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from bjrump as a code owner October 11, 2026 08:13
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 11, 2026
@vercel

vercel Bot commented Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
car-check Ready Ready Preview Oct 11, 2026 8:16am UTC

@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 11, 2026
@dependabot dependabot Bot mentioned this pull request Oct 11, 2026
Closed
@coderabbitai

coderabbitai Bot commented Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 7de661c1-2eaa-4fd5-927a-4f63525a08d5
📥 Commits

Reviewing files that changed from the base of the PR and between ae94548 and e8c6842.

⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (1)
  • package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

📝 Walkthrough

Walkthrough

The @clerk/nextjs dependency requirement in package.json changes from ^7.9.2 to ^7.9.12.

Changes

Clerk dependency update

Layer / File(s) Summary
Update Clerk version range
package.json		 The @clerk/nextjs version range changes from ^7.9.2 to ^7.9.12.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk | ⚪ Minimal · up to e8c68

Merge Risk: ⚪ Minimal · up to e8c68

The dependency update is consistent with the lockfile, and no concrete application impact requiring resolution before merge was established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to e8c68

The application’s authentication call sites and inspected data-ownership checks are unchanged, and no introduced authorization bypass was established. However, the upgraded authentication library’s verification behavior could not be compared, leaving limited security uncertainty.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The dependency replacement reaches authentication handling for matched application and API requests and the client identity bridge to Convex. Its potential reach is broader than one route, but no newly exposed route or privilege increase was established.

Trust Boundaries and Controls

  • observed — Inspected Convex vehicle handlers enforce data authorization separately from the Next.js proxy. Reads require identity and restrict results to the resolved owner; creation assigns that owner; deletion first checks identity and ownership. Owner resolution uses a tokenIdentifier-indexed alias or the tokenIdentifier itself. These application-owned controls predate this PR.
  • inferred — The inspected ownership checks constrain data access but do not prove that the upgraded Clerk implementation preserves token or session verification semantics. Middleware implementation and route-specific authorization behavior remain unresolved, rather than verified vulnerabilities or evidence of safety.
Pre-merge checks | Passed 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely identifies the dependency update from @clerk/nextjs 7.9.2 to 7.9.12.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@dependabot @github

dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #422.

@dependabot dependabot Bot closed this Oct 18, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/clerk/nextjs-7.9.12 branch October 18, 2026 08:14

This branch was successfully deployed

1 active deployment
Preview — e8c68423 Deployed Oct 11, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bjrump bjrump Awaiting requested review from bjrump bjrump is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants