@auth0/nextjs-auth0 - npm Package Versions

v4.8.0 (2025-07-03)

Full Changelog

Added

• feat: Add alternate logout strategy #2203 (tusharpandey13)
• feat: add withPageAuthRequired for protecting pages client side #2193 (guabu)

Fixed

• Use max-age=0 to delete cookie #2200 (guabu)
• feat: update id_token when a new Access Token is fetched #2189 (tusharpandey13)

v4.7.0 (2025-06-20)

Full Changelog

Added

• feat: support basePath configuration #2167 (guabu)

Fixed

• fix: typo in warning message #2169 (J-Amberg)
• fix: handle authorization code grant request errors #2175 (guabu)
• fix: Properly configure SDK to be distributed as ESM #2171 (frederikprijck)
• fix: consistently treat returnTo parameter as an absolute path #2185 (guabu)

Changed

• Export filterDefaultIdTokenClaims and update beforeSessionSaved docs #2119 (frederikprijck)
• return a 204 from the profile endpoint when unauthenticated (opt-in) #2159 (guabu)
• remove unnecessary error logs #2179 (guabu)
• Bump msw from 2.7.5 to 2.9.0 #2139 (dependabot)
• Bump msw from 2.9.0 to 2.10.2 #2153 (dependabot)
• Bump oauth4webapi from 3.5.1 to 3.5.2 #2154 (dependabot)
• Bump oauth4webapi from 3.5.2 to 3.5.3 #2177 (dependabot)

v4.6.1 (2025-06-04)

Full Changelog

Changed

• Bump codecov/codecov-action from 5.4.2 to 5.4.3 #2102 (dependabot[bot])

Fixed

• Fixes CVE-2025-48947
• Fix Missing idToken during Session Migration from v3 to v4 #2116 #2120 (KentoMoriwaki)
• fix(session): prevent accidental deletion of legacy-named session cookie #2114 (nandan-bhat)
• fix(client): add type-safe return for getAccessToken #2115 (nandan-bhat)

v4.6.0 (2025-05-21)

Full Changelog

Added

• feature/conditionally update session handleAccessToken #2054 (tusharpandey13)
• Add missing support for legacy chunked cookies #2071 (tusharpandey13)

Changed

• Update middleware combination example to prevent unintended backend execution #2076 (tusharpandey13)
• Bump eslint-plugin-react from 7.37.4 to 7.37.5 #2091 (dependabot[bot])
• Bump @playwright/test from 1.50.1 to 1.52.0 #2092 (dependabot[bot])
• Bump @vitest/coverage-v8 from 2.1.4 to 2.1.9 #2093 (dependabot[bot])
• Bump typescript-eslint from 8.32.0 to 8.32.1 #2094 (dependabot[bot])
• Bump eslint-config-prettier from 10.0.1 to 10.1.5 #2090 (dependabot[bot])
• Bump oauth4webapi from 3.1.4 to 3.5.1 #2085 (dependabot[bot])
• chore(deps): bump @eslint/plugin-kit from 0.2.2 to 0.2.7 in /examples/with-shadcn #1995 (dependabot[bot])
• build(deps): bump jose from 5.9.6 to 5.10.0 #1956 (dependabot[bot])
• Bump codecov/codecov-action from 5.3.1 to 5.4.2 #2058 (dependabot[bot])
• Bump swr from 2.3.2 to 2.3.3 #2086 (dependabot[bot])
• Bump typescript-eslint from 8.24.0 to 8.32.0 #2084 (dependabot[bot])
• chore(deps): bump next from 15.0.2 to 15.2.3 in /examples/with-shadcn #1986 (dependabot[bot])
• Bump next from 15.0.3 to 15.2.4 in /examples/with-next-intl #2029 (dependabot[bot])
• Update deleteByLogoutToken arg type in EXAMPLES.md #2067 (ammubhave)
• Bump @auth0/nextjs-auth0 from 4.0.1 to 4.5.1 in /examples/with-shadcn #2073 (dependabot[bot])
• Bump @eslint/js from 9.20.0 to 9.26.0 #2078 (dependabot[bot])
• Bump vite from 5.4.14 to 5.4.19 #2075 (dependabot[bot])
• Bump typedoc from 0.27.7 to 0.28.4 #2079 (dependabot[bot])
• chore(deps-dev): bump globals from 15.14.0 to 15.15.0 #1969 (dependabot[bot])
• chore(deps-dev): bump prettier from 3.4.2 to 3.5.3 #1967 (dependabot[bot])

Fixed

• Usability upgrades to V4 Migration Guide #2095 (nandan-bhat)
• Bugfix: Add clockTolerance to cookie decryption #2097 (tusharpandey13)
• Fix stacking transaction cookies #2077 (tusharpandey13)

v4.5.1 (2025-04-29)

Full Changelog

Security

• fix: Ensure JWE expires as expected #2040 (frederikprijck)

v4.5.0 (2025-04-25)

Full Changelog

Added

• Extensive Cookie Configuration #2059 (tusharpandey13)
• Allow refresh: true in getAccessToken() #2055 (tusharpandey13)
• Allow SWR mutation in useUser hook #2045 (tusharpandey13)

Changed

• Update README regarding access-token endpoint #2044 (frederikprijck)

Fixed

• Update tests for getAccessToken refresh flow #2068 (tusharpandey13)
• fix: make configuration validation not throw #2034 (tusharpandey13)
• feat: ensure cookie path is configurable #2050 (frederikprijck)

v4.4.2 (2025-04-08)

Full Changelog

Revert

• revert: fix: Properly configure SDK to be distributed as ESM #2046 (frederikprijck)

Fixed

• fix: Add id_token_hint on logout #2041 (frederikprijck)

v4.4.1 (2025-04-03)

Full Changelog

Fixed

• fix: Properly configure SDK to be distributed as ESM #2028 (frederikprijck)
• Fix broken links in jsdocs #2031 (frederikprijck)
• fix: Throw ConfigurationError when invalid Auth0Client configuration #2026 (tusharpandey13)

v4.4.0 (2025-04-01)

Full Changelog

Added

• Add note about access-token endpoint to README #2020 (frederikprijck)
• Add support for Connection Access Token #2010 (frederikprijck)

Fixed

• fix: Delete legacy cookie once v4 cookie is set #2019 (frederikprijck)
• fix: Ensure to delete cookies when switching from single to chunks and vica versa #2013 (frederikprijck)
• fix: Clean up cookie chunks when cookie size shrinks #2014 (frederikprijck)
• fix: use NEXT_PUBLIC_PROFILE_ROUTE in Auth0Provider #2021 (tusharpandey13)
• fix: Ensure to pass-through enableAccessTokenEndpoint #2015 (frederikprijck)
• fix: Remove obsolete warning about cookie-size #2012 (frederikprijck)