# What changed in @clerk/nextjs

> 100 changes in @clerk/nextjs 6 to 7 from its official release notes, upgrade guides and advisories: 39 breaking, 5 deprecations, 10 security, 26 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@clerk/nextjs/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @clerk/nextjs 7

### Breaking changes

- Missing Clerk keys no longer activate keyless mode; the SDK throws an error directing you to run npx clerk@latest init to provision an application and write keys to .env.local. (7.8.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.8.0)
- Using the removed Protect component now triggers a runtime migration error. (7.7.5) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.7.5)
- Using the removed SignedIn component now triggers a runtime migration error. (7.7.5) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.7.5)
- Using the removed SignedOut component now triggers a runtime migration error. (7.7.5) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.7.5)
- Removed the component from the public API in favor of usage within OrganizationProfile. (7.5.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.0)
- Middleware authorization now fails closed during the keyless bootstrap window, preventing auth.protect() and custom authorization checks from being bypassed while the publishable key is being provisioned. (7.3.1) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.3.1)
- Legacy redirect props are no longer exported; components rely on new redirect options and server-side configuration. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Legacy redirect props are no longer exported; components rely on new redirect options and server-side configuration. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- OrganizationSwitcher no longer exports this prop. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Unauthenticated server action requests now receive 401 instead of 404. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- When passing secretKey as a runtime option to clerkMiddleware(), a missing encryption key now throws; configure this environment variable. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed from all SDKs; pin @clerk/clerk-js by passing its Clerk constructor to ClerkProvider via the Clerk prop. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed along with the headless bundle; use prefetchUI={false} instead. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed from all SDKs; pin @clerk/clerk-js by passing its Clerk constructor to ClerkProvider via the Clerk prop. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- This type alias is no longer exported. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed from all SDKs; pass ui from @clerk/ui to ClerkProvider via the ui prop to pin a version. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed from all SDKs; pass ui from @clerk/ui to ClerkProvider via the ui prop to pin a version. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- No longer exported. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Methods previously prefixed experimental__* and experimental_* are renamed to __experimental_* for beta features. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed deprecated option. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- When the client is offline, getToken() now throws ClerkOfflineError instead of returning null. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Organization hideSlug flags are no longer exported. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- useAuth no longer accepts initialAuthState; pass initialState to ClerkProvider or use dynamic with the Next package. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Methods previously prefixed __unstable_* are renamed to __internal_* for internal APIs. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Renamed from __unstable_invokeMiddlewareOnAuthStateChange. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Support for Next.js 13 and 14 is dropped; Next.js >=15.2.3 is required. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- The minimum supported Node version is now v20.9.0. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Use prefetchUI={false} in place of the removed clerkJSVariant option and headless bundle. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed in favor of Show. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Legacy redirect props are no longer exported; components rely on new redirect options and server-side configuration. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- The beforeEmit option is no longer exported. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Introduced as the cross-framework authorization control component, replacing Protect, SignedIn, and SignedOut. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed in favor of Show. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed in favor of Show. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed deprecated billing-related prop. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed deprecated billing-related prop. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Removed deprecated billing-related prop. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- During SSR, getToken is now a function rather than undefined, and calling it throws; handle the error instead of checking for undefined. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- UserButton sign-out overrides are no longer exported. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)

### Security

- Isolates each request's store so dynamic secret keys used by clerkClient() inside the middleware handler cannot leak across concurrent requests. (7.9.5) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.5)
- CSP headers generated by clerkMiddleware() now allow Clerk abuse and fraud protection resources. (7.5.21) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.21)
- Known credential keys are now recursively truncated at any nesting depth, preventing bearer tokens from reaching debug logs. (7.5.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.0)
- Keyless mode no longer activates in CI and other automated environments. (7.4.3) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.4.3)
- If you use the Next.js App Router, upgrade to Next.js 15.5.18, 16.2.6, or a later patched release; versions 16.0.0 through 16.2.5 remain affected by a Middleware/Proxy bypass. (7.3.5) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.3.5)
- Middleware-to-origin auth header integrity signatures are now compared in constant time, avoiding timing-variable validation and working in both Node and Edge Runtime. (7.2.8) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.2.8)
- URL paths are normalized to prevent route protection bypass. (6.39.2, 7.2.1) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.2.1), [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.39.2)
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass (6.39.2, 7.2.1) — [security advisory](https://github.com/advisories/GHSA-VQX2-FGX2-5WQ9)
- If you use the Next.js App Router, upgrade Next.js to 15.5.15 or 16.2.3 to address a high-severity React Server Components denial-of-service vulnerability. (7.1.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.1.0)
- The generated CSP nonce is now forwarded as a request header, allowing server components and ClerkProvider to apply it to script tags. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)

### Deprecations

- The removed control-component stub is now tagged @deprecated, so editors and lint rules flag use at authoring time and provide <Show> migration guidance. (7.8.4) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.8.4)
- The removed control-component stub is now tagged @deprecated, so editors and lint rules flag use at authoring time and provide <Show> migration guidance. (7.8.4) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.8.4)
- The removed control-component stub is now tagged @deprecated, so editors and lint rules flag use at authoring time and provide <Show> migration guidance. (7.8.4) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.8.4)
- Deprecated in favor of resource-based auth checks, which place checks in each protected page, layout, API route, or Server Function. (7.5.14) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.14)
- The existing type remains unchanged but is now deprecated. (7.5.13) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.13)

### New APIs and options

- Adds an authenticated component for approving or denying OAuth Device Authorization Grant requests. (7.9.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.0)
- Adds a workflow hook for approving or denying OAuth Device Authorization Grant requests. (7.9.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.0)
- Frontend API proxy helpers accept an fapiUrl option so requests can target a custom Clerk Frontend API URL. (7.6.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.6.0)
- Set CLERK_DISABLE_AUTO_PROXY=true to opt out of automatic Frontend API proxying on Vercel production deployments. (7.5.19) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.19)
- Exported as the new type-level autocomplete suggestion for route matchers, using the :path* subtree form. (7.5.13) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.13)
- Exported this previously internal type so it can be referenced from generated docs. (7.5.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.0)
- Exported this previously internal type so it can be referenced from generated docs. (7.5.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.0)
- Exported this previously internal type so it can be referenced from generated docs. (7.5.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.0)
- Exposed OAuthConsent as a public component export across React-based SDKs. (7.3.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.3.0)
- Re-exports the useAPIKeys() hook from @clerk/nextjs so applications can use it directly. (7.0.12) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.12)
- New /types subpath re-exports shared and SDK-specific types so applications can import Clerk types directly from the SDK package. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- New query parameter tracks satellite sync state: 1 triggers handshake after primary sign-in and 2 prevents a re-sync loop after completion. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Exported error to identify offline token-fetch failures from getToken(). (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- New ui prop accepts @clerk/ui, enabling the UI module to be passed directly to ClerkProvider. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Adds Frontend API proxy support through the clerkMiddleware option. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Standalone function retrieves session tokens outside framework component trees and waits for Clerk to initialize in the browser. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Component handles the SSO callback during custom flows, including sign-in-or-up. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Defaults to false, skipping automatic satellite handshake when no session cookies exist; set true to retain automatic first-load syncing. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Introduces a session task named setup_mfa. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Option disables the development mode warning emitted to the console when Clerk is first loaded. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Component lets developers choose the container for Clerk floating UI portals within its provider subtree. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Exported hook fetches a suggested organization name and logo from default naming rules. (6.37.0, 7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0), [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.37.0)
- Exports for the useWaitlist hook were added. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)

### Behavior and default changes

- The default Content Security Policy no longer includes https://images.clerkstage.dev, a Clerk-internal storage host that applications do not connect to. (7.9.11) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.11)
- The generated connect-src directive allows Clerk abuse and fraud protection hosts on all ports, so requests to those hosts on non-443 ports are no longer blocked. (7.7.8) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.7.8)
- ConfigureSSO is no longer on the experimental path. (7.4.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.4.0)
- On `.vercel.app` domains without explicit proxy or domain configuration, Frontend API requests are automatically routed through `/__clerk` on the app's own origin, enabling Clerk production mode without manual proxy setup. (7.2.8) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.2.8)
- Image CDNs are now included in the Content Security Policy connect-src directive. (6.36.8, 7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0), [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.36.8)

### Fixes and other changes

- Export <HandleSSOCallback /> from @clerk/nextjs so it can be used on the SSO callback route of a custom flow. (7.9.13) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.13)
- Removed the trailing period from the displayed error so agents do not append it to the URL and get a 404. (7.9.9) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.9)
- Fixes a development-only React key warning when using ClerkProvider in the App Router. (7.9.5) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.5)
- Fixed a stray double space in the error message about Clerk not detecting usage of clerkMiddleware(). (7.7.6) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.7.6)
- The error message when clerkMiddleware is not detected now notes that infrastructure issues, such as edge runtime errors or platform outages, can also cause the error. (7.3.2) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.3.2)
- Fixes build failures when cacheComponents is enabled with dynamic routes such as [id]. (7.0.2) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.2)
- Fixed an edge case where duplicate in-flight redirects to the same destination could leave awaitable navigation pending indefinitely. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)
- Improved error detection and messages when auth() or currentUser() are called inside a use cache function. (7.0.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.0.0)

## @clerk/nextjs 6

### New APIs and options

- M2M token creation accepts tokenFormat: 'jwt'; JWT-format tokens can be verified with clerkClient.m2m.verify, including networkless verification using the public JWT key. (6.39.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.39.0)
- Introduces an MFA setup session task for handling require MFA after sign-in and sign-up. (6.38.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.38.0)
- Introduces the TaskResetPassword session task component for handling password resets. (6.36.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.36.0)

### Behavior and default changes

- Updates the supported API version to 2025-11-10. (6.35.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.35.0)

### Fixes and other changes

- Fixes an infinite handshake redirect loop when deploying Next.js apps with Clerk development instances to Netlify. (6.38.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.38.0)
- JWT OAuth access tokens are now treated as machine tokens. (6.37.2) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.37.2)
- Updates the middleware location check to account for proxy.ts in Next 16+ applications. (6.37.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.37.0)
- React 19 peer dependency ranges use ~ instead of ^ to ensure non-overlapping version constraints. (6.36.5) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.36.5)
- Extends the cache invalidation no-op to Next.js 16 during sign-out. (6.35.2) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.35.2)
- Added support for Next.js 16. (6.34.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%406.34.0)