chore(deps): update dependency @auth0/nextjs-auth0 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@auth0/nextjs-auth0	3.7.0 -> 4.6.0

---

Release Notes

auth0/nextjs-auth0 (@​auth0/nextjs-auth0)

v4.6.0

Compare Source

Full Changelog

Added

• feature/conditionally update session handleAccessToken #​2054 (tusharpandey13)
• Add missing support for legacy chunked cookies #​2071 (tusharpandey13)

Changed

• Update middleware combination example to prevent unintended backend execution #​2076 (tusharpandey13)
• Bump eslint-plugin-react from 7.37.4 to 7.37.5 #​2091 (dependabot[bot])
• Bump @​playwright/test from 1.50.1 to 1.52.0 #​2092 (dependabot[bot])
• Bump @​vitest/coverage-v8 from 2.1.4 to 2.1.9 #​2093 (dependabot[bot])
• Bump typescript-eslint from 8.32.0 to 8.32.1 #​2094 (dependabot[bot])
• Bump eslint-config-prettier from 10.0.1 to 10.1.5 #​2090 (dependabot[bot])
• Bump oauth4webapi from 3.1.4 to 3.5.1 #​2085 (dependabot[bot])
• chore(deps): bump @​eslint/plugin-kit from 0.2.2 to 0.2.7 in /examples/with-shadcn #​1995 (dependabot[bot])
• build(deps): bump jose from 5.9.6 to 5.10.0 #​1956 (dependabot[bot])
• Bump codecov/codecov-action from 5.3.1 to 5.4.2 #​2058 (dependabot[bot])
• Bump swr from 2.3.2 to 2.3.3 #​2086 (dependabot[bot])
• Bump typescript-eslint from 8.24.0 to 8.32.0 #​2084 (dependabot[bot])
• chore(deps): bump next from 15.0.2 to 15.2.3 in /examples/with-shadcn #​1986 (dependabot[bot])
• Bump next from 15.0.3 to 15.2.4 in /examples/with-next-intl #​2029 (dependabot[bot])
• Update deleteByLogoutToken arg type in EXAMPLES.md #​2067 (ammubhave)
• Bump @​auth0/nextjs-auth0 from 4.0.1 to 4.5.1 in /examples/with-shadcn #​2073 (dependabot[bot])
• Bump @​eslint/js from 9.20.0 to 9.26.0 #​2078 (dependabot[bot])
• Bump vite from 5.4.14 to 5.4.19 #​2075 (dependabot[bot])
• Bump typedoc from 0.27.7 to 0.28.4 #​2079 (dependabot[bot])
• chore(deps-dev): bump globals from 15.14.0 to 15.15.0 #​1969 (dependabot[bot])
• chore(deps-dev): bump prettier from 3.4.2 to 3.5.3 #​1967 (dependabot[bot])

Fixed

• Usability upgrades to V4 Migration Guide #​2095 (nandan-bhat)
• Bugfix: Add clockTolerance to cookie decryption #​2097 (tusharpandey13)
• Fix stacking transaction cookies #​2077 (tusharpandey13)

v4.5.1

Compare Source

Full Changelog

Security

• fix: Ensure JWE expires as expected #​2040 (frederikprijck)

v4.5.0

Compare Source

Full Changelog

Added

• Extensive Cookie Configuration #​2059 (tusharpandey13)
• Allow refresh: true in getAccessToken() #​2055 (tusharpandey13)
• Allow SWR mutation in useUser hook #​2045 (tusharpandey13)

Changed

• Update README regarding access-token endpoint #​2044 (frederikprijck)

Fixed

• Update tests for getAccessToken refresh flow #​2068 (tusharpandey13)
• fix: make configuration validation not throw #​2034 (tusharpandey13)
• feat: ensure cookie path is configurable #​2050 (frederikprijck)

v4.4.2

Compare Source

Full Changelog

Revert

• revert: fix: Properly configure SDK to be distributed as ESM #​2046 (frederikprijck)

Fixed

• fix: Add id_token_hint on logout #​2041 (frederikprijck)

v4.4.1

Compare Source

Full Changelog

Fixed

• fix: Properly configure SDK to be distributed as ESM #​2028 (frederikprijck)
• Fix broken links in jsdocs #​2031 (frederikprijck)
• fix: Throw ConfigurationError when invalid Auth0Client configuration #​2026 (tusharpandey13)

v4.4.0

Compare Source

Full Changelog

Added

• Add note about access-token endpoint to README #​2020 (frederikprijck)
• Add support for Connection Access Token #​2010 (frederikprijck)

Fixed

• fix: Delete legacy cookie once v4 cookie is set #​2019 (frederikprijck)
• fix: Ensure to delete cookies when switching from single to chunks and vica versa #​2013 (frederikprijck)
• fix: Clean up cookie chunks when cookie size shrinks #​2014 (frederikprijck)
• fix: use NEXT_PUBLIC_PROFILE_ROUTE in Auth0Provider #​2021 (tusharpandey13)
• fix: Ensure to pass-through enableAccessTokenEndpoint #​2015 (frederikprijck)
• fix: Remove obsolete warning about cookie-size #​2012 (frederikprijck)

v4.3.0

Compare Source

Full Changelog

Added

• Access Token Exposure Control #​1979 (tusharpandey13)
• Cookie chunking support #​1975 (tusharpandey13)
• Add idToken to TokenSet in SessionData #​1978 (tusharpandey13)

v4.2.1

Compare Source

Full Changelog

Changed

• Bump next in SDK as well as examples #​1992 (frederikprijck)

v4.2.0

Compare Source

Full Changelog

Security

• Enforce nextjs peerDependency to 14.2.25 and 15.2.3 #​1988 (frederikprijck)

The above security fix was done to help prevent customers being vulnerable to Authorization Bypass in Next.js Middleware.

v4.1.0

Compare Source

Full Changelog

Added

• Programmatic PAR #​1946 (tusharpandey13)

Fixed

• fix: stop importing named export from package.json #​1962 (tusharpandey13)

v4.0.3

Compare Source

Full Changelog

Fixed

• Fix route matching when Next.js trailingSlash is enabled #​1948 (tusharpandey13)
• fix: allow appBaseUrl to not be the root #​1941 (frederikprijck)

v4.0.2

Compare Source

Full Changelog

Changed

• Update API DOCs link on the README.md #​1914 (nandan-bhat)
• Updating API DOCs #​1913 (nandan-bhat)

Fixed

• fix: read and migrate v3 session format to v4 #​1923 (guabu)
• fix/updateV4MigrationGuide #​1925 (tusharpandey13)

v4.0.1

Compare Source

Full Changelog

Fixed

• fix: sanitize the returnTo parameter to prevent open redirect vulnerabilities. #​1897 (guabu)

v4.0.0

Compare Source

⚠️ BREAKING CHANGES.

Significant updates have been introduced in this release. Please refer to the V3 → V4 MIGRATION GUIDE for details on upgrading.

Fixed

• chore: add telemetry and options to disable in #​1864
• chore: reduce session lifetime defaults in #​1869
• fix: persist access token scope in tokenset in #​1870
• chore: in-memory cache for authorization server metadata in #​1871

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.