Update dependency @clerk/nextjs to v4.29.3 [SECURITY] by renovate[bot] · Pull Request #75 · khulnasoft/kexample

renovate · 2024-08-09T05:43:34Z

This PR contains the following updates:

Package	Change	Age	Confidence
@clerk/nextjs (source)	`4.25.5` → `4.29.3`

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

CVE-2024-22206 / GHSA-q6w5-jg5q-47vg

More information

Details

Impact

Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.

Affected Versions

All applications that that use @clerk/nextjs versions in the range of >= 4.7.0,< 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or Route handlers. Specifically, those that call auth() in the App Router or getAuth() in the Pages Router. Only the @clerk/nextjs SDK is impacted. Other SDKs, including other Javascript-based SDKs, are not impacted.

Patches

Fix included in @clerk/nextjs@4.29.3.

References

Severity

CVSS Score: 9.0 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

clerk/javascript (@clerk/nextjs)

`v4.29.3`

Compare Source

Patch Changes

Replace the Clerk-Backend-SDK header with User-Agent in BAPI requests and update it's value to contain both the package name and the package version of the clerk package (#2579) by @nikosdouvlis

executing the request. Eg request from @clerk/nextjs to BAPI with append User-Agent: @clerk/nextjs@5.0.0-alpha-v5.16 using the latest version.

Miscellaneous changes: The backend test build changed to use tsup.
Updated dependencies [c59a2d4a2, 2a615bf98]:
- @clerk/clerk-sdk-node@4.13.6
- @clerk/backend@0.37.2

Minor Changes

Support reading from __clerk_db_jwt and __dev_session the dev browser jwt in development (#2428) by @dimkl

Patch Changes

Updated dependencies [df40705d3, a8feab74a]:
- @clerk/shared@1.2.0
- @clerk/backend@0.36.1
- @clerk/clerk-react@4.30.1
- @clerk/clerk-sdk-node@4.13.3

`v4.28.1`

Compare Source

Patch Changes

Update NextJS quickstart link in error message (#2354) by @dimkl

`v4.28.0`

Compare Source

Minor Changes

Introduce Protect for authorization. (#2309) by @panteliselef

Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the experimental tags and prefixes
- Drop some from the has utility and Protect. Protect now accepts a condition prop where a function is expected with the has being exposed as the param.
- Protect can now be used without required props. In this case behaves as <SignedIn>, if no authorization props are passed.
- has will throw an error if neither permission or role is passed.
- auth().protect() for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
  - inside a page or layout file it will render the nearest not-found component set by the developer
  - inside a route handler it will return empty response body with a 404 status code

Patch Changes

Accept redirectUrl as an option for auth().protect(). (#2333) by @panteliselef

For example:

// Authorization
auth().protect({ role: 'org:admin' }, { redirectUrl: '/any-page' });
auth().protect({ permission: 'org:settings:manage' }, { redirectUrl: '/any-page' });

// Authentication
auth().protect({ redirectUrl: '/any-page' });

Updated dependencies [b4868ab8f, 2dc93d4d8]:
- @clerk/types@3.60.0
- @clerk/backend@0.36.0
- @clerk/clerk-react@4.30.0
- @clerk/clerk-sdk-node@4.13.2

`v4.27.7`

Compare Source

Patch Changes

Use dynamic imports in <ClerkProvider /> which you import from @clerk/nextjs. (#2292) by @LekoArts

Users on Next.js 12 and older can run into errors like these:
```
error - ./node_modules/@&#8203;clerk/nextjs/dist/esm/app-router/client/ClerkProvider.js:10:22
Module not found: Can't resolve 'next/navigation'
```
The aforementioned <ClerkProvider /> component contains code for both Next.js 12 (+ older) and Next.js 13 (+ newer). On older versions it can't find the imports only available in newer versions.

If you're seeing these errors, you have to do two things:
1. Update @clerk/nextjs to this version
2. Update your next.config.js to ignore these imports:
```
const webpack = require('webpack');

/** @&#8203;type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
  webpack(config) {
    config.plugins.push(
      new webpack.IgnorePlugin({ resourceRegExp: /^next\/(navigation|headers|compat\/router)$/ }),
    );
    return config;
  },
};

module.exports = nextConfig;
```
  It is safe to ignore these modules as your Next.js 12 app won't hit these code paths.

`v4.27.6`

Compare Source

Patch Changes

Updated dependencies [a62479810]:
- @clerk/clerk-react@4.29.0
- @clerk/types@3.59.0
- @clerk/backend@0.35.1
- @clerk/clerk-sdk-node@4.13.1

`v4.27.5`

Compare Source

Patch Changes

Updated dependencies [31ee1438a, 7ef3414ba, c7763fa60, 12b362923]:
- @clerk/types@3.58.1
- @clerk/backend@0.35.0
- @clerk/clerk-sdk-node@4.13.0
- @clerk/clerk-react@4.28.3

`v4.27.4`

Compare Source

Patch Changes

Drop the introduction of OrganizationRole and OrganizationPermission resources fro BAPI. (#2257) by @panteliselef
Ensure that cookies set inside Next.js Middleware are correctly passed through while using authMiddleware. (#2260) by @clerk-cookie
Updated dependencies [11fdbcb39]:
- @clerk/clerk-sdk-node@4.12.23
- @clerk/backend@0.34.3

`v4.27.3`

Compare Source

Patch Changes

Updated dependencies [7130db0fb]:
- @clerk/clerk-react@4.28.2

`v4.27.2`

Compare Source

Patch Changes

Add OrganizationPermissionAPI for CRUD operations regarding instance level organization permissions. (#2185) by @panteliselef
Updated dependencies [aaaf24a55, e41374abf, e41374abf, e61df051c, 9d8a29b8e]:
- @clerk/backend@0.34.2
- @clerk/shared@1.1.1
- @clerk/clerk-sdk-node@4.12.22
- @clerk/clerk-react@4.28.1

`v4.27.1`

Compare Source

Patch Changes

Updated dependencies [1df2ffe77]:
- @clerk/backend@0.34.1
- @clerk/clerk-sdk-node@4.12.21

`v4.27.0`

Compare Source

Minor Changes

Experimental support for <Gate/> with role checks. (#2051) by @panteliselef

Patch Changes

Fix type inferance for auth helper. (#2049) by @panteliselef
Updated dependencies [7fa8fbcf2, 068a9025c, 4c3429010, d7fe11ede, 20eab8365, f9d1bc758, f652a5618, 4f9214aca]:
- @clerk/shared@1.1.0
- @clerk/types@3.58.0
- @clerk/backend@0.34.0
- @clerk/clerk-react@4.28.0
- @clerk/clerk-sdk-node@4.12.20

`v4.26.2`

Compare Source

Patch Changes

Deprecate user, session, and organization resources from the returned value of auth(). (#1960) by @panteliselef
Imports deprecatedObjectProperty from @clerk/shared as subpath. (#1989) by @clerk-cookie
Updated dependencies [f6f67f9ab, a8d7a687e, 7b91aca54, 0f8aedd62, bc19fe025, 60ea712fa]:
- @clerk/types@3.57.1
- @clerk/shared@1.0.2
- @clerk/backend@0.33.0
- @clerk/clerk-react@4.27.2
- @clerk/clerk-sdk-node@4.12.19

`v4.26.1`

Compare Source

Patch Changes

Updated dependencies [29a5f5641]:
- @clerk/shared@1.0.1
- @clerk/backend@0.32.1
- @clerk/clerk-react@4.27.1
- @clerk/clerk-sdk-node@4.12.18

`v4.26.0`

Compare Source

Minor Changes

Add support for NextJS 14 (#1948) by @desiprisg

Patch Changes

Updated dependencies [088724324, 5d379bcbf]:
- @clerk/backend@0.32.0
- @clerk/clerk-sdk-node@4.12.17

`v4.25.7`

Compare Source

Patch Changes

Fix an issue where only static routes would be allowed by publicRoutes prop from authMiddleware. (#1928) by @desiprisg
Publish packages with npm provenance enabled (#1891) by @LekoArts
Update <ClerkProvider /> to work in client components within the app router. This allows rendering of the provider in client components, previously the pages router provider was being imported and throwing an error. (#1840) by @BRKalow
Update imports of @clerk/shared to granular entrypoints. This addresses warnings during a Next.js build that are the result of unsupported APIs being included in the module graph of builds for the edge runtime. (#1924) by @BRKalow
Updated dependencies [3bf64107e, 52f8553d2, 92727eec3, b09b66eec, 51861addf, 37d8856ba, aa4cd7615]:
- @clerk/clerk-sdk-node@4.12.16
- @clerk/backend@0.31.3
- @clerk/shared@1.0.0
- @clerk/clerk-react@4.27.0
- @clerk/types@3.57.0

`v4.25.6`

Compare Source

Patch Changes

Update the error thrown by auth() or getAuth() to indicate that if the /src directory exists, then the middleware.ts file needs to be placed inside it, otherwise the middleware will not run. (#1908) by @nikosdouvlis
Updated dependencies [9ca215702]:
- @clerk/types@3.56.1
- @clerk/backend@0.31.2
- @clerk/clerk-react@4.26.6
- @clerk/clerk-sdk-node@4.12.15

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2025-01-25T03:24:39Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

renovate Bot added the Mend: dependency security fix label Aug 29, 2024

renovate Bot removed the Mend: dependency security fix label Nov 5, 2024

renovate Bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 9398604 to 47ef87d Compare January 25, 2025 03:24

Update dependency @clerk/nextjs to v4.29.3 [SECURITY]

6c468ec

renovate Bot force-pushed the renovate/npm-clerk-nextjs-vulnerability branch from 47ef87d to 6c468ec Compare March 8, 2026 06:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency @clerk/nextjs to v4.29.3 [SECURITY]#75

Update dependency @clerk/nextjs to v4.29.3 [SECURITY]#75
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-clerk-nextjs-vulnerability

renovate Bot commented Aug 9, 2024 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jan 25, 2025

Review skipped

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Details

Impact

Affected Versions

Patches

References

Severity

References

Release Notes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

coderabbitai Bot commented Jan 25, 2025

Review skipped

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 9, 2024 •

edited

Loading

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

CodeRabbit Configuration File (`.coderabbit.yaml`)