Latest @clerk/nextjs package uses deprecated dependency.
RicardoGEsteves opened this issue · 1 comments
Preliminary Checks
-
I have reviewed the documentation: https://clerk.com/docs
-
I have searched for existing issues: https://github.com/clerk/javascript/issues
-
I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)
-
This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.
Reproduction
Publishable key
.
Description
Latest @clerk/nextjs package introduced a deprecated dependency, you are using @types/mime@4.0.0.
That dependency is deprecated and can create some unwanted vulnerabilities!
WARN 1 deprecated subdependencies found: @types/mime@4.0.0
dependencies:
@clerk/nextjs 4.29.10
└─┬ @clerk/clerk-sdk-node 4.13.12
├─┬ @types/cookies 0.7.7
│ └─┬ @types/express 4.17.14
│ ├─┬ @types/express-serve-static-core 4.17.43
│ │ └─┬ @types/send 0.17.4
│ │ └── @types/mime 1.3.5
│ └─┬ @types/serve-static 1.15.7
│ └─┬ @types/send 0.17.4
│ └── @types/mime 1.3.5
└─┬ @types/express 4.17.14
├─┬ @types/express-serve-static-core 4.17.43
│ └─┬ @types/send 0.17.4
│ └── @types/mime 1.3.5
└─┬ @types/serve-static 1.15.7
└─┬ @types/send 0.17.4
└── @types/mime 1.3.5
Environment
System:
OS: Linux 6.1 Debian GNU/Linux 12 (bookworm) 12 (bookworm)
CPU: (2) x64 AMD EPYC
Memory: 1.85 GB / 4.01 GB
Container: Yes
Shell: Unknown
Binaries:
Node: 20.9.0 - /usr/local/bin/node
Yarn: 1.22.19 - /usr/local/bin/yarn
npm: 9.8.1 - /usr/local/bin/npm
pnpm: 8.10.2 - /usr/local/share/npm-global/bin/pnpm
npmPackages:
@clerk/nextjs: ^4.29.10 => 4.29.10
@types/node: ^20 => 20.11.5
@types/react: ^18 => 18.2.48
@types/react-dom: ^18 => 18.2.18
eslint: ^8 => 8.56.0
eslint-config-next: 14.1.0 => 14.1.0
next: 14.1.0 => 14.1.0
react: ^18 => 18.2.0
react-dom: ^18 => 18.2.0
typescript: ^5 => 5.3.3You can check the mimo repo for more context: https://github.com/broofa/mime#readme, but migrating to v4 that package for types its not needed:
Hi, thanks for the issue. Your issue is a duplicate of #3074 and the underlying issue was already fixed here: DefinitelyTyped/DefinitelyTyped#69231
When I do a fresh install of @clerk/nextjs it shows that it's working as intended:
playground/nextjs-mime-test is 📦 1.0.0 via ⬢ v20.11.1
➜ yarn add @clerk/nextjs
yarn add v1.22.19
info No lockfile found.
[1/4] 🔍 Resolving packages...
[2/4] 🚚 Fetching packages...
[3/4] 🔗 Linking dependencies...
warning "@clerk/nextjs > @clerk/clerk-react@4.30.8" has unmet peer dependency "react@>=16".
warning "@clerk/nextjs > @clerk/shared > swr@2.2.0" has unmet peer dependency "react@^16.11.0 || ^17.0.0 || ^18.0.0".
warning "@clerk/nextjs > @clerk/shared > swr > use-sync-external-store@1.2.0" has unmet peer dependency "react@^16.8.0 || ^17.0.0 || ^18.0.0".
warning " > @clerk/nextjs@4.29.10" has unmet peer dependency "next@>=10".
warning " > @clerk/nextjs@4.29.10" has unmet peer dependency "react@^17.0.2 || ^18.0.0-0".
warning " > @clerk/nextjs@4.29.10" has unmet peer dependency "react-dom@^17.0.2 || ^18.0.0-0".
[4/4] 🔨 Building fresh packages...
success Saved lockfile.
success Saved 45 new dependencies.
info Direct dependencies
└─ @clerk/nextjs@4.29.10
info All dependencies
├─ @clerk/clerk-react@4.30.8
├─ @clerk/clerk-sdk-node@4.13.12
├─ @clerk/nextjs@4.29.10
├─ @peculiar/asn1-schema@2.3.8
├─ @peculiar/webcrypto@1.4.1
├─ @types/cookies@0.7.7
├─ @types/express-serve-static-core@4.17.43
├─ @types/express@4.17.14
├─ @types/http-errors@2.0.4
├─ @types/keygrip@1.0.6
├─ @types/mime@1.3.5
├─ @types/node-fetch@2.6.2
├─ @types/range-parser@1.2.7
├─ asn1js@3.0.5
├─ asynckit@0.4.0
├─ camelcase-keys@6.2.2
├─ camelcase@5.3.1
├─ combined-stream@1.0.8
├─ cookie@0.5.0
├─ csstype@3.1.1
├─ deepmerge@4.2.2
├─ delayed-stream@1.0.0
├─ dot-case@3.0.4
├─ form-data@3.0.1
├─ glob-to-regexp@0.4.1
├─ js-cookie@3.0.1
├─ lower-case@2.0.2
├─ map-obj@4.3.0
├─ mime-db@1.52.0
├─ mime-types@2.1.35
├─ no-case@3.0.4
├─ node-fetch-native@1.0.1
├─ path-to-regexp@6.2.1
├─ pvutils@1.1.3
├─ quick-lru@4.0.1
├─ snake-case@3.0.4
├─ snakecase-keys@3.2.1
├─ swr@2.2.0
├─ to-no-case@1.0.2
├─ to-snake-case@1.0.0
├─ to-space-case@1.0.0
├─ type-fest@2.19.0
├─ undici-types@5.26.5
├─ use-sync-external-store@1.2.0
└─ webcrypto-core@1.7.9
✨ Done in 6.21s.
playground/nextjs-mime-test is 📦 1.0.0 via ⬢ v20.11.1 took 6.4s
➜ yarn why @types/mime
yarn why v1.22.19
[1/4] 🤔 Why do we have the module "@types/mime"...?
[2/4] 🚚 Initialising dependency graph...
[3/4] 🔍 Finding dependency...
[4/4] 🚡 Calculating file sizes...
=> Found "@types/mime@1.3.5"
info Reasons this module exists
- "@clerk#nextjs#@clerk#clerk-sdk-node#@types#express#@types#express-serve-static-core#@types#send" depends on it
- Hoisted from "@clerk#nextjs#@clerk#clerk-sdk-node#@types#express#@types#express-serve-static-core#@types#send#@types#mime"
info Disk size without dependencies: "24KB"
info Disk size with unique dependencies: "24KB"
info Disk size with transitive dependencies: "24KB"
info Number of shared dependencies: 0
✨ Done in 0.04s.