Merge branch 'main' into v4-migration-profile-no-content-option

Author: frederikprijck

.github/dependabot.yml

@@ -7,8 +7,17 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 5
+      semver-minor-days: 5
+      semver-patch-days: 3
 
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
       interval: 'daily'
+    cooldown:
+      default-days: 5
+      semver-major-days: 10
+      semver-minor-days: 5
+      semver-patch-days: 3

.github/workflows/codeql.yml

@@ -36,7 +36,7 @@ jobs:
         run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/npm-release.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       # Checkout the code
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.github/workflows/playwright.yml

@@ -10,7 +10,7 @@ jobs:
     timeout-minutes: 60
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - uses: actions/setup-node@v6
       with:
         node-version: lts/*
@@ -26,7 +26,7 @@ jobs:
 
     - name: Run Playwright tests
       run: pnpm exec playwright test
-    - uses: actions/upload-artifact@v5
+    - uses: actions/upload-artifact@v6
       if: ${{ !cancelled() }}
       with:
         name: playwright-report

.github/workflows/rl-secure.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.github/workflows/snyk.yml

@@ -31,7 +31,7 @@ jobs:
       - if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
         run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
 

.github/workflows/test.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -48,7 +48,7 @@ jobs:
           node: ${{ env.NODE_VERSION }}
 
       - name: Save build artifacts
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: .
           key: ${{ env.CACHE_KEY }}
@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -83,7 +83,7 @@ jobs:
         run: pnpm test:coverage
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # pin@5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # pin@5.5.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -93,7 +93,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4

.gitignore

@@ -141,5 +141,4 @@ dist
 *.tmp
 *PLAN*.md
 .yalc/
-yalc.lock
-.npmrc
+yalc.lock

.version

@@ -1 +1 @@
-v4.13.1
+v4.14.0

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Change Log
 
+## [v4.14.0](https://github.com/auth0/nextjs-auth0/tree/v4.14.0) (2025-12-15)
+[Full Changelog](https://github.com/auth0/nextjs-auth0/compare/v4.13.3...v4.14.0)
+
+**Added**
+- feat: Custom Token Exchange [\#2453](https://github.com/auth0/nextjs-auth0/pull/2453) ([tusharpandey13](https://github.com/tusharpandey13))
+
+## [v4.13.3](https://github.com/auth0/nextjs-auth0/tree/v4.13.3) (2025-12-12)
+[Full Changelog](https://github.com/auth0/nextjs-auth0/compare/v4.13.2...v4.13.3)
+
+**Fixed**
+- bugfix: session write not happening for pages router with chunked cookies [\#2447](https://github.com/auth0/nextjs-auth0/pull/2447) ([tusharpandey13](https://github.com/tusharpandey13))
+
+**Security**
+- Security: Update Next.js peer dependencies for CVE-2025-55184 and CVE-2025-55183 [\#2457](https://github.com/auth0/nextjs-auth0/pull/2457) ([tusharpandey13](https://github.com/tusharpandey13))
+
+## [v4.13.2](https://github.com/auth0/nextjs-auth0/tree/v4.13.2) (2025-12-05)
+[Full Changelog](https://github.com/auth0/nextjs-auth0/compare/v4.13.1...v4.13.2)
+
+**Changed**
+- Updated peer dependency
+  - Next: `^14.2.25 || ~15.0.5 || ~15.1.9 || ~15.2.6 || ~15.3.6 || ~15.4.8 || ~15.5.7 || ^16.0.7`
+  - React: `^18.0.0 || ~19.0.1 ||  ~19.1.2 || ^19.2.1`
+  - React-DOM: `^18.0.0 || ~19.0.1 ||  ~19.1.2 || ^19.2.1`
+
 ## [v4.13.1](https://github.com/auth0/nextjs-auth0/tree/v4.13.1) (2025-11-19)
 [Full Changelog](https://github.com/auth0/nextjs-auth0/compare/v4.13.0...v4.13.1)