build(deps-dev): bump @clerk/clerk-js from 6.7.4 to 6.7.5

[dependabot]

Bumps @clerk/clerk-js from 6.7.4 to 6.7.5.

Changelog

Sourced from @​clerk/clerk-js's changelog.

6.7.5

Patch Changes

• Fix an authorization bypass in has(), auth.protect(), and related predicates when a single call combined conditions from more than one dimension (for example, { permission, reverification } or { feature, permission }). A dimension that should have denied the request was treated as indeterminate and ignored by the combining logic, allowing other passing dimensions to carry the result and authorize the call when it should have failed closed. (#8372) by @​nikosdouvlis

  Behavior is now:

  • When a requested dimension cannot be satisfied because the underlying session data is missing, malformed, or invalid, the call denies. Previously these cases were treated as indeterminate and ignored, which could let another passing dimension carry the call.
  • Fixed a minor bug where session.checkAuthorization() was building authorization options from the membership row id instead of the organization id.

  Single-condition role, permission, feature, and plan checks (has({ permission }), etc.) are unchanged. Single-condition reverification checks are unchanged on well-formed session data; calls with a missing or malformed factorVerificationAge payload now deny where they previously returned indeterminate. Callback-form auth.protect(has => ...) is unaffected unless the callback itself invokes the affected shapes.

  Separately, auth.protect() in @clerk/nextjs previously discarded authorization params (role, permission, feature, plan, reverification) whenever the same argument object also contained unauthenticatedUrl, unauthorizedUrl, or token. TypeScript's excess-property check caught this for inline object literals but did not apply once the argument was assigned to a variable, spread, or used from JavaScript. Mixed-shape calls like auth.protect({ role: 'org:admin', unauthorizedUrl: '/denied' }) or auth.protect({ permission: 'org:X', token: 'session_token' }) now correctly enforce the authorization check instead of silently letting every authenticated caller through.

• Updated dependencies [d52b311]:

  • @​clerk/shared@​4.8.3

Commits

• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
zudoku-cosmo-cargo	Ready	Preview, Comment	May 11, 2026 10:29am
zudoku-dev	Ready	Preview, Comment	May 11, 2026 10:29am

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	62.12% 🟰 ±0%	3389 / 5455
🔵	Statements	61.1% 🟰 ±0%	3580 / 5859
🔵	Functions	51.54% 🟰 ±0%	801 / 1554
🔵	Branches	50.5% 🟰 ±0%	2330 / 4613

File Coverage

No changed files found.

Generated in workflow #5319 for commit 9a93069 by the Vitest Coverage Report Action

[github-actions]

Preview build of published Zudoku package for commit 9a93069.

See the deployment at: https://3309aa70.cosmocargo-public-package.pages.dev

Note

This is a preview of the Cosmo Cargo example using the Zudoku package published to a local registry to ensure it'll be working when published to the public NPM registry.

Last updated: 2026-05-11T10:35:38.287Z

[dependabot]

Looks like @clerk/clerk-js is up-to-date now, so this is no longer needed.