chore(deps): Bump the arcjet-apps-major group with 2 updates

dependabot[bot] commented 2 weeks ago

Bumps the arcjet-apps-major group with 2 updates: @clerk/nextjs and next.

Updates @clerk/nextjs from 5.7.5 to 6.1.0

Release notes

Sourced from @clerk/nextjs's releases.

@clerk/nextjs@6.1.0

Minor Changes
Bug fix: For next>=14 applications resolve __unstable__onBeforeSetActive once invalidateCacheAction resolves. (#4362) by @panteliselef
Introduce a new experimental hook called useReverification that makes it easy to handle reverification errors. (#4362) by @panteliselef

It returns a high order function (HOF) and allows developers to wrap any function that triggers a fetch request which might fail due to a user's session verification status. When such error is returned, the recommended UX is to offer a way to the user to recover by re-verifying their credentials. This helper will automatically handle this flow in the developer's behalf, by displaying a modal the end-user can interact with. Upon completion, the original request that previously failed, will be retried (only once).

Example with clerk-js methods.
import { __experimental_useReverification as useReverification } from "@clerk/nextjs";
function DeleteAccount() {
const { user } = useUser();
const [deleteUserAccount] = useReverification(() => {
if (!user) return;
return user.delete();
});
return (
<>
<button
onClick={async () => {
await deleteUserAccount();
}}
>
Delete account
</button>
</>
);
}
Replace next/headers with ezheaders (#4392) by @panteliselef
Patch Changes

Fixes a bug where <ClerkProvider dynamic> would error when rendered in a Next.js 13 application using the App Router. (#4421) by @BRKalow

Updating peerDependencies for correct ranges (#4436) by @jacekradko

Updated dependencies [69c8f4f21, f875463da, 41f2ede56, 5be7ca9fd, 08c5a2add, 08c5a2add, 24cd77989, 434b432f8]:

@clerk/clerk-react@5.14.0

@clerk/types@4.29.0

@clerk/shared@2.11.0

... (truncated)

Changelog

Sourced from @clerk/nextjs's changelog.

6.1.0

Minor Changes
Bug fix: For next>=14 applications resolve __unstable__onBeforeSetActive once invalidateCacheAction resolves. (#4362) by @panteliselef
Introduce a new experimental hook called useReverification that makes it easy to handle reverification errors. (#4362) by @panteliselef

It returns a high order function (HOF) and allows developers to wrap any function that triggers a fetch request which might fail due to a user's session verification status. When such error is returned, the recommended UX is to offer a way to the user to recover by re-verifying their credentials. This helper will automatically handle this flow in the developer's behalf, by displaying a modal the end-user can interact with. Upon completion, the original request that previously failed, will be retried (only once).

Example with clerk-js methods.
import { __experimental_useReverification as useReverification } from "@clerk/nextjs";
function DeleteAccount() {
const { user } = useUser();
const [deleteUserAccount] = useReverification(() => {
if (!user) return;
return user.delete();
});
return (
<>
<button
onClick={async () => {
await deleteUserAccount();
}}
>
Delete account
</button>
</>
);
}
Replace next/headers with ezheaders (#4392) by @panteliselef
Patch Changes

Fixes a bug where <ClerkProvider dynamic> would error when rendered in a Next.js 13 application using the App Router. (#4421) by @BRKalow

Updating peerDependencies for correct ranges (#4436) by @jacekradko

Updated dependencies [69c8f4f21, f875463da, 41f2ede56, 5be7ca9fd, 08c5a2add, 08c5a2add, 24cd77989, 434b432f8]:

@clerk/clerk-react@5.14.0

@clerk/types@4.29.0

... (truncated)

Commits

15f6718 ci(repo): Version packages (#4417)
18545c7 feat(nextjs): Replace jest with vitest for unit tests (#4298)
08c5a2a feat(clerk-react,nextjs,shared): Introduce experimental useReverification (...
24cd779 fix(nextjs): Correct peerDependencies (#4436)
34d673a chore(nextjs): Use ezheaders to access headers and cookies (#4392)
41f2ede chore(repo): Update tests for next 15 (#4421)
1cc8737 ci(repo): Version packages (#4401)
e8ccb55 fix(nextjs): Include protect types in auth (#4398)
46e54ed ci(repo): Version packages (#4390)
eccfc03 fix(nextjs): Fix cookies() usage in server action (#4396)
Additional commits viewable in compare view

Updates next from 14.2.15 to 15.0.2

Release notes

Sourced from next's releases.

v15.0.2

Core Changes

Read page name from work store in server module map proxy: #71669

codemod: should not transform when param is not used: #71664

[dynamicIO] complete refactor to prerender: #71687

fix: metadata image route normalize path posix for windows: #71673

next-codemod(upgrade): optional catch when missing dev script: #71598

Avoid server action function indirection in Turbopack: #71628

fix: exclude basePath in findSourceMapURL: #71719

fix: stack frame text color in dark mode: #71656

Fix: revert the bad node binary handling: #71723

next-codemod: add empty pnpm-workspace.yaml to test fixtures to bypass PNPM workspace checks: #71726

warn on sync access if dynamicIO is not enabled: #71696

Update React from 69d4b800-20241021 to 45804af1-20241021: #71718

next-upgrade: do not add --turbopack flag when --turbo exists in next dev: #71730

feat: stitch errors with react owner stack: #70393

[dynamicIO] update data access error and documentation: #71738

Test cached form action with revalidate: #71591

Upgrade React from 45804af1-20241021 to 28668d39-20241023: #71745

Fix race condition when setting client reference manifests: #71741

Fix fetch with no-store inside of use cache: #71754

Remove the bottom collapse button in dev overlay: #71658

[dynamicIO] unify cache filling and lazy-module warming: #71749

Don't filter out source location frames through RSC: #71752

fix undefined default export error msg: #71762

Upgrade React from 28668d39-20241023 to 1631855f-20241023: #71769

Enable owner stack in experimental build: #71716

feat: add experiment for sharpjs cpu flags: #71733

fix: handle server component replay error in error overlay: #71772

Don't error asking for prebuilt bundles: #71778

Replace turbopack://[project]/... sourcemap uris with file://... in development: #71489

misc: update source map paths for bundled Next.js runtime: #71779

[dynamicIO] refine error message and docs: #71781

next-upgrade: change --turbo to --turbopack if applicable: #71737

Show all diff when uncollapse: #71792

Sourcemap errors in terminal by default : #71444

Fully enable custom error callbacks for app router: #71794

Simplify Server Action Webpack plugin: #71721

ensure DIO development segment errors are cleared after correcting: #71811

Include sourceframe in errors logged in the terminal during development: #71803

[dynamicIO] update prerender cache scoping and cache warming for validation: #71822

only force stack frame color in tty: #71860

Add test for fetch with auth in use cache: #71768

Fix race with hot-reloader-client clearing overlay errors: #71771

Fix dynamic tracking in dev: #71867

Revert "Sourcemap errors in terminal by default (#71444)": #71868

Fix fetch caching inside of "use cache": #71793

Trace upload: only send traces for current session: #71838

Reland "Sourcemap errors in terminal by default": #71877

... (truncated)

Commits

2e28c96 v15.0.2
9fe44a5 v15.0.2-canary.11
1fb8361 Compare error stack to dedupe error (#71798)
14b92e6 fix: log the error instance modified extra location info (#71930)
b2bc1ed Fix swc version mismatch when checking out an older version (#71978)
256b662 Docs: Address internal use cache comments (#71981)
3f2d2f6 correct expire calc & and Nested usage import in use-cache docs (#71899)
3768aea Documentation Fix: Correct cacheTag Function Usage (#71912)
4db1ae9 docs: update file structure (#71951)
6ae6605 (docs) use cache: Add text code formatting (#71999)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

vercel[bot] commented 2 weeks ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
arcjet-docs	❌ Failed (Inspect)			Nov 1, 2024 10:34pm

socket-security[bot] commented 2 weeks ago

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@clerk/nextjs@6.1.0	Transitive: environment, network	`+23`	6.78 MB	nikosdouvlis
npm/next@15.0.2	environment, filesystem, network, shell, unsafe	`+22`	1.27 GB	vercel-release-bot

🚮 Removed packages: npm/@clerk/nextjs@5.7.5, npm/next@14.2.15

View full report↗︎

socket-security[bot] commented 2 weeks ago

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
Shell access	npm/next@15.0.2	Module: child_process Location: Package overview	`package-lock.json` `package.json`	🚫

View full report↗︎

Next steps

What is shell access?

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/next@15.0.2

dependabot[bot] commented 1 week ago

Looks like these dependencies are no longer updatable, so this is no longer needed.

arcjet / arcjet-docs