[Snyk] Security upgrade @clerk/nextjs from 5.5.2 to 5.7.2

[snyk-io]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	601/1000 Why? Recently disclosed, Has a fix available, CVSS 6.3	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @clerk/nextjs

The new version differs by 125 commits.

• d724a36 ci(repo): Version packages (#4307)
• 358be29 fix(backend): Expose permissions field for OrganizationMembership (#4310)
• b0a85b4 chore(clerk-sdk-node): Add transition period notice and migration info (#4305)
• e50ce1b chore(clerk-js): Update `OrganizationSwitcher` popover action to include label (#4304)
• 68720e1 chore(repo): Fix Release action (#4306)
• 34b47d1 chore(clerk-js): Remove unused babel dependencies (#4300)
• bd92d38 feat(fastify)!: Support Fastify v5 (#4270)
• bf78fe0 fix(elements): Remove example mode guard from passkey event in verification flow (#4295)
• 2ea1a60 feat(nextjs): Handle URL <> Session Org Mismatch in Middleware (#3977)
• 6ca754e ci(repo): Version packages (#4288)
• a46c44e fix(clerk-js): Handle gracefully Coinbase Wallet use of existing Passkey (#4302)
• d546ea2 fix(remix): Update dependency cookie to v0.7.0 [SECURITY] (#4294)
• 60934ad fix(repo): Update non-deterministic package-lock.json (#4293)
• 7c50da4 chore(astro): Fix vulnerability caused by `dset` package (#4289)
• 00a9ddb feat(localizations): Add be-BY localization (#4280)
• e29a806 fix(localizations): Update de-DE translation to be GDPR-compliant (#4195)
• 7719d1b chore(repo): Bump webpack from 5.91.0 to 5.94.0 (#4287)
• 0d56455 fix(nextjs): do not build test file declarations (#4286)
• e11dbac ci(repo): Version packages (#4284)
• 3b6d510 chore(repo): Node 20 / attw change (#4283)
• 8471c25 chore(repo): Update dependency postcss to ^8.4.47 (#4258)
• c46dd72 chore(repo): Update dependency express to v4.20.0 [SECURITY] (#4285)
• c6d0ffd chore(repo): Update dependency express to v4.20.0 [SECURITY] (#4208)
• c647c7e chore(repo): Update dependency typescript to v5.6.2 (#4066)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview