[jayypatel18]

DocsFlow is on @clerk/nextjs 6, which is Clerk Core 2. Clerk's schedule ends long term support for Core 2 in January 2027. Core 3 needs Next.js 15.2.8 or later and Node 20.9 or later. The repo is on Next.js 15.5.12 and CI runs Node 20, so only Clerk moves.

• Upgrade guide: https://clerk.com/docs/guides/development/upgrading/upgrade-guides/core-3
• Versioning and support schedule: https://clerk.com/docs/guides/development/upgrading/versioning

What changed

• package.json, package-lock.json: @clerk/nextjs ^6.33.0 to ^7.0.0 (resolves to 7.9.9).
• components/login-page.tsx, components/signup-page.tsx, app/verify-email/page.tsx: useSignIn and useSignUp now come from @clerk/nextjs/legacy. Core 3 gave these hooks a new return shape; the /legacy entry point keeps the shape the custom login, signup and verify-email forms are written against, so the forms themselves are untouched.
• app/sso-callback/page.tsx: handleRedirectCallback no longer takes afterSignInUrl and afterSignUpUrl. They become signInFallbackRedirectUrl and signUpFallbackRedirectUrl, both still /onboarding.

What I checked

In a clean Node 20 container, on main and then on this branch, with install scripts off:

Step	main	this branch
npm ci	ok	ok
npm test (the CI job)	29 passed in 2 files	29 passed in 2 files
tsc --noEmit	116 errors	the same 116 errors

All 116 type errors are in four test files (test/rag-multimodal-parser.test.ts, test/auth-integration.test.ts, app/api/onboarding/complete/route.test.ts, lib/ai/providers.test.ts) that use Jest globals without types. The application code type-checks clean on both sides.

Not checked: sign-in, sign-up and the OAuth callback against a real Clerk instance. Those are the flows this PR touches, so they are worth a click-through on a preview deploy before merging.

Worth a look

• The /legacy hooks are Clerk's supported way to keep the old flow working in Core 3. Moving the three forms to the new hook API is a separate, larger change.
• Core 3 behaviour changes that no rewrite covers are listed in the upgrade guide. One to know about in client code: getToken() throws ClerkOfflineError when the browser is offline instead of returning null.

Summary by CodeRabbit

• Authentication
  • Updated authentication handling across sign-in, sign-up, email verification, and SSO.
  • Successful SSO sign-ins continue to lead to onboarding; failed attempts return to login with an error.
  • No visible changes to the sign-in, sign-up, or email verification experience are included in this update.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 05b51fa8-4bcb-4c3a-91b6-3a07b0424acf

📥 Commits

Reviewing files that changed from the base of the PR and between 3e6fd71 and 7a21df5.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• app/sso-callback/page.tsx
• app/verify-email/page.tsx
• components/login-page.tsx
• components/signup-page.tsx
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Clerk dependency range changes from ^6.33.0 to ^7.0.0. Authentication call sites use fallback redirect options or import selected hooks from @clerk/nextjs/legacy.

Changes

Clerk v7 compatibility

Layer / File(s)	Summary
Dependency and authentication call sites package.json, app/sso-callback/page.tsx, app/verify-email/page.tsx, components/login-page.tsx, components/signup-page.tsx	The Clerk dependency range changes to ^7.0.0. The SSO callback replaces afterSignInUrl and afterSignUpUrl with fallback redirect options, both set to /onboarding. The verify-email and signup pages import useSignUp from @clerk/nextjs/legacy. The login page imports useSignIn from that entry point and keeps useUser imported from @clerk/nextjs.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: nicuk

Merge Risk: 🔵 Low · up to 7a21d

The Clerk v7 upgrade looks mechanically consistent. Before merging, click through sign-in, sign-up and the OAuth callback on a preview deploy, and confirm the hosting runtime is Node 20.9 or later.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 7a21d

The application retains fixed redirect destinations and activates sessions only after completed verification. No introduced authorization bypass was established. However, authentication failure, replay, and recovery behavior have not been demonstrated against a real Clerk instance, so risk is not minimal.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The upgrade's potential exposure extends beyond the two public pages: selected dependency relationships include the session API, metadata synchronization route, and circuit-breaker actions. These consumers inherit the shared SDK change, but the selected relationships are not an exhaustive authorization or tenant-isolation assessment.

Trust Boundaries and Controls

• observed — Onboarding checks the server session endpoint and redirects unauthenticated responses to login. That endpoint obtains identity through Clerk's server auth and currentUser APIs and returns authenticated=false when either identity is absent or an exception occurs. Navigation to onboarding alone therefore does not establish authenticated identity.

Resilience and Maintainability Implications

• observed — The installed v7 callback wrapper invokes the underlying handler without awaiting its completion and suppresses promise rejection, or queues the call while unloaded. The application's await cannot establish completed callback processing, and its catch is not a dependable SDK failure signal. Whether this differs from v6 remains unresolved; it is not an established PR-introduced bypass.
• observed — Verification, session activation, and navigation are separate steps. Error handling clears loading state but does not roll back activation; visible controls limit ordinary duplicate submissions without establishing backend idempotency. This application behavior predates the PR, and SDK handling of concurrent calls and partial activation remains unverified.

Hardening Proposals

• proposed — Validate the upgraded flows against a real Clerk instance with invalid and replayed OAuth responses, unloaded callback state, interrupted navigation, repeated verification, concurrent verification and resend, and partial activation failure. Confirm that authenticated identity and session ownership remain correct across recovery, rather than treating navigation or promise resolution as authentication success.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 4 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading @clerk/nextjs to version 7 and Clerk Core 3.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 4 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jayypatel18]

Hi nicuk,

A gentle follow up on this PR. It upgrades your clerk package to the latest supported package before EOL of current package.

Once you get time kindly take a look at this PR, your time is much appreciated!

Thanks,
Jay