Skip to content

Bump js-cookie and @clerk/nextjs - #5

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-3cf2085a65
Open

Bump js-cookie and @clerk/nextjs#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-3cf2085a65

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 27, 2026

Copy link
Copy Markdown
Contributor

Bumps js-cookie to 3.0.7 and updates ancestor dependency @clerk/nextjs. These dependencies need to be updated together.

Updates js-cookie from 3.0.1 to 3.0.7

Release notes

Sourced from js-cookie's releases.

v3.0.7

  • Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)
  • Add Partitioned attribute to readme (b994768)
  • Publish to npm registry via trusted publisher exclusively (4dc71be)
  • Ensure consistent behaviour for get('name') + get() (1953d30)

v3.0.5

  • Remove npm version restriction in package.json - #818

v3.0.4

  • Publish to npmjs.com with package provenance
Commits
  • 17bacba Craft v3.0.7 release
  • adb823c Fix release workflow halting at git tag
  • 5f9e759 May remove Git user config from release workflow
  • 6ac9211 Fix release workflow not able to push commit + tag
  • 2278bc5 Fix missing package version bump
  • eb3c40e Prevent cookie attribute injection
  • f6f157f Bump globals from 17.5.0 to 17.6.0
  • f409d02 Bump eslint from 10.2.0 to 10.3.0
  • a686883 Bump protobufjs in the npm_and_yarn group across 1 directory
  • c6112d2 Bump @​protobufjs/utf8 in the npm_and_yarn group across 1 directory
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.


Updates @clerk/nextjs from 4.31.5 to 7.4.1

Release notes

Sourced from @​clerk/nextjs's releases.

@​clerk/nextjs@​7.4.1

Patch Changes

  • Updated dependencies [a036ce8]:
    • @​clerk/shared@​4.13.1
    • @​clerk/react@​6.7.1
    • @​clerk/backend@​3.4.13

@​clerk/nextjs@​7.4.0

Minor Changes

Patch Changes

@​clerk/nextjs@​7.3.7

Patch Changes

@​clerk/nextjs@​6.39.5

Patch Changes

@​clerk/nextjs@​6.39.4

Patch Changes

  • Updated dependencies [fbba78c]:
    • @​clerk/shared@​3.47.6
    • @​clerk/backend@​2.33.4
    • @​clerk/clerk-react@​5.61.7
    • @​clerk/types@​4.101.24
Changelog

Sourced from @​clerk/nextjs's changelog.

7.4.1

Patch Changes

  • Updated dependencies [a036ce8]:
    • @​clerk/shared@​4.13.1
    • @​clerk/react@​6.7.1
    • @​clerk/backend@​3.4.13

7.4.0

Minor Changes

Patch Changes

7.3.7

Patch Changes

7.3.6

Patch Changes

  • Updated dependencies [4fc38a0]:
    • @​clerk/shared@​4.12.1
    • @​clerk/react@​6.6.5
    • @​clerk/backend@​3.4.10

7.3.5

Patch Changes

  • Bump next devDependency to 15.5.18 to pick up the fix for GHSA-26hh-7cqf-hhc6, a high-severity (CVSS 7.5) Middleware/Proxy bypass in App Router applications via segment-prefetch routes (incomplete-fix follow-up). If you use the Next.js App Router, we recommend upgrading to Next.js 15.5.18, 16.2.6, or a later patched release. The 16.0.0 through 16.2.5 versions are still affected. (#8547) by @​jacekradko

  • Updated dependencies [9fa6642, 930047f, b45777c, 5441d86, 5a7225e]:

    • @​clerk/shared@​4.12.0
    • @​clerk/react@​6.6.4
    • @​clerk/backend@​3.4.9

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​clerk/nextjs since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-cookie](https://github.com/js-cookie/js-cookie) to 3.0.7 and updates ancestor dependency [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs). These dependencies need to be updated together.


Updates `js-cookie` from 3.0.1 to 3.0.7
- [Release notes](https://github.com/js-cookie/js-cookie/releases)
- [Commits](js-cookie/js-cookie@v3.0.1...v3.0.7)

Updates `@clerk/nextjs` from 4.31.5 to 7.4.1
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.4.1/packages/nextjs)

---
updated-dependencies:
- dependency-name: js-cookie
  dependency-version: 3.0.7
  dependency-type: indirect
- dependency-name: "@clerk/nextjs"
  dependency-version: 7.4.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 27, 2026
@vercel

vercel Bot commented May 27, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
thread Error Error May 27, 2026 1:01pm

@netlify

netlify Bot commented May 27, 2026

Copy link
Copy Markdown

Deploy Preview for dainty-rolypoly-f4ddf2 failed.

Name Link
🔨 Latest commit ca286d2
🔍 Latest deploy log https://app.netlify.com/projects/dainty-rolypoly-f4ddf2/deploys/6a16eb13c0ee830008c5ab2c

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants