chore(deps): update dependency @auth0/nextjs-auth0 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@auth0/nextjs-auth0	3.8.0 -> 4.11.0

---

Release Notes

auth0/nextjs-auth0 (@​auth0/nextjs-auth0)

v4.11.0

Compare Source

Full Changelog

Added

• feat: Add DPoP (Demonstrating Proof-of-Possession) #​2357 (tusharpandey13)
• feat: add support for connected accounts #​2344 (guabu)
• Add support for access tokens with difference audiences (MRRT) #​2333 (frederikprijck)

Fixed

• fix: ensure Connected Accounts use fetcher to properly use DPoP #​2366 (frederikprijck)
• fix: ensure fetcher honors token_type #​2365 (frederikprijck)
• fix: address typos in comments and examples #​2347 (frederikprijck)

v4.10.0

Compare Source

Full Changelog

Added

• feat: control sending id_token_hint in OIDC logout URL #​2300 (tusharpandey13)
• feat: Allow access token grant type for federated connections #​2240 (tusharpandey13)
• feat: add federated logout #​2313 (tusharpandey13)
• feat: Add organizations #​2282 (tusharpandey13)
• feat: add support for backchannel authentication #​2261 (guabu)

Changed

• feat: simplify PAR parameter handling by removing redundant filtering #​2298 (tusharpandey13)

Fixed

• fix: Remove unsafe type assertion in withPageAuthRequired HOC #​2305 (tusharpandey13)
• fix: parameter name of requested_expiry #​2304 (guabu)
• fix: ensure to mark StartInteractiveLoginOptions as optional #​2272 (frederikprijck)

v4.9.0

Compare Source

Full Changelog

Added

• feat: Allow configuring transaction cookie maxAge #​2245 (tusharpandey13)
• feat: Add flag to control parallel transactions #​2244 (tusharpandey13)
• feat: add support for withApiAuthRequired helper #​2230 (guabu)
• feat: add withPageAuthRequired for server #​2207 (guabu)

Fixed

• bugfix: respect path configuration when deleting cookies #​2250 (tusharpandey13)
• bugfix: Clear cookies with the correct path when basePath is used #​2232 (tusharpandey13)
• bugfix: Fix clientAssertionSigningKey type mismatch #​2243 (tusharpandey13)
• fix: correctly handle expired JWE's in cookies #​2082 (frederikprijck)

Security

• chore: pin eslint-config-prettier and eslint-plugin-prettier versions to prevent malicious package installation #​2239 (tusharpandey13)

v4.8.0

Compare Source

Full Changelog

Added

• feat: Add alternate logout strategy #​2203 (tusharpandey13)
• feat: add withPageAuthRequired for protecting pages client side #​2193 (guabu)

Fixed

• Use max-age=0 to delete cookie #​2200 (guabu)
• feat: update id_token when a new Access Token is fetched #​2189 (tusharpandey13)

v4.7.0

Compare Source

Full Changelog

Added

• feat: support basePath configuration #​2167 (guabu)

Fixed

• fix: typo in warning message #​2169 (J-Amberg)
• fix: handle authorization code grant request errors #​2175 (guabu)
• fix: Properly configure SDK to be distributed as ESM #​2171 (frederikprijck)
• fix: consistently treat returnTo parameter as an absolute path #​2185 (guabu)

Changed

• Export filterDefaultIdTokenClaims and update beforeSessionSaved docs #​2119 (frederikprijck)
• return a 204 from the profile endpoint when unauthenticated (opt-in) #​2159 (guabu)
• remove unnecessary error logs #​2179 (guabu)
• Bump msw from 2.7.5 to 2.9.0 #​2139 (dependabot)
• Bump msw from 2.9.0 to 2.10.2 #​2153 (dependabot)
• Bump oauth4webapi from 3.5.1 to 3.5.2 #​2154 (dependabot)
• Bump oauth4webapi from 3.5.2 to 3.5.3 #​2177 (dependabot)

v4.6.1

Compare Source

Full Changelog

Fixed

• Fixes CVE-2025-48947
• Fix Missing idToken during Session Migration from v3 to v4 #​2116 #​2120 (KentoMoriwaki)
• fix(session): prevent accidental deletion of legacy-named session cookie #​2114 (nandan-bhat)
• fix(client): add type-safe return for getAccessToken #​2115 (nandan-bhat)

v4.6.0

Compare Source

Full Changelog

Added

• feature/conditionally update session handleAccessToken #​2054 (tusharpandey13)
• Add missing support for legacy chunked cookies #​2071 (tusharpandey13)

Changed

• Update middleware combination example to prevent unintended backend execution #​2076 (tusharpandey13)

Fixed

• Bugfix: Add clockTolerance to cookie decryption #​2097 (tusharpandey13)
• Fix stacking transaction cookies #​2077 (tusharpandey13)

v4.5.1

Compare Source

Full Changelog

Security

• fix: Ensure JWE expires as expected #​2040 (frederikprijck)

v4.5.0

Compare Source

Full Changelog

Added

• Extensive Cookie Configuration #​2059 (tusharpandey13)
• Allow refresh: true in getAccessToken() #​2055 (tusharpandey13)
• Allow SWR mutation in useUser hook #​2045 (tusharpandey13)

Changed

• Update README regarding access-token endpoint #​2044 (frederikprijck)

Fixed

• Update tests for getAccessToken refresh flow #​2068 (tusharpandey13)
• fix: make configuration validation not throw #​2034 (tusharpandey13)
• feat: ensure cookie path is configurable #​2050 (frederikprijck)

v4.4.2

Compare Source

Full Changelog

Revert

• revert: fix: Properly configure SDK to be distributed as ESM #​2046 (frederikprijck)

Fixed

• fix: Add id_token_hint on logout #​2041 (frederikprijck)

v4.4.1

Compare Source

Full Changelog

Fixed

• fix: Properly configure SDK to be distributed as ESM #​2028 (frederikprijck)
• Fix broken links in jsdocs #​2031 (frederikprijck)
• fix: Throw ConfigurationError when invalid Auth0Client configuration #​2026 (tusharpandey13)

v4.4.0

Compare Source

Full Changelog

Added

• Add note about access-token endpoint to README #​2020 (frederikprijck)
• Add support for Connection Access Token #​2010 (frederikprijck)

Fixed

• fix: Delete legacy cookie once v4 cookie is set #​2019 (frederikprijck)
• fix: Ensure to delete cookies when switching from single to chunks and vica versa #​2013 (frederikprijck)
• fix: Clean up cookie chunks when cookie size shrinks #​2014 (frederikprijck)
• fix: use NEXT_PUBLIC_PROFILE_ROUTE in Auth0Provider #​2021 (tusharpandey13)
• fix: Ensure to pass-through enableAccessTokenEndpoint #​2015 (frederikprijck)
• fix: Remove obsolete warning about cookie-size #​2012 (frederikprijck)

v4.3.0

Compare Source

Full Changelog

Added

• Access Token Exposure Control #​1979 (tusharpandey13)
• Cookie chunking support #​1975 (tusharpandey13)
• Add idToken to TokenSet in SessionData #​1978 (tusharpandey13)

v4.2.1

Compare Source

Full Changelog

Changed

• Bump next in SDK as well as examples #​1992 (frederikprijck)

v4.2.0

Compare Source

Full Changelog

Security

• Enforce nextjs peerDependency to 14.2.25 and 15.2.3 #​1988 (frederikprijck)

The above security fix was done to help prevent customers being vulnerable to Authorization Bypass in Next.js Middleware.

v4.1.0

Compare Source

Full Changelog

Added

• Programmatic PAR #​1946 (tusharpandey13)

Fixed

• fix: stop importing named export from package.json #​1962 (tusharpandey13)

v4.0.3

Compare Source

Full Changelog

Fixed

• Fix route matching when Next.js trailingSlash is enabled #​1948 (tusharpandey13)
• fix: allow appBaseUrl to not be the root #​1941 (frederikprijck)

v4.0.2

Compare Source

Full Changelog

Changed

• Update API DOCs link on the README.md #​1914 (nandan-bhat)
• Updating API DOCs #​1913 (nandan-bhat)

Fixed

• fix: read and migrate v3 session format to v4 #​1923 (guabu)
• fix/updateV4MigrationGuide #​1925 (tusharpandey13)

v4.0.1

Compare Source

Full Changelog

Fixed

• fix: sanitize the returnTo parameter to prevent open redirect vulnerabilities. #​1897 (guabu)

v4.0.0

Compare Source

⚠️ BREAKING CHANGES.

Significant updates have been introduced in this release. Please refer to the V3 → V4 MIGRATION GUIDE for details on upgrading.

Fixed

• chore: add telemetry and options to disable in #​1864
• chore: reduce session lifetime defaults in #​1869
• fix: persist access token scope in tokenset in #​1870
• chore: in-memory cache for authorization server metadata in #​1871

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.