chore(nextjs): Update next to patched versions for GHSA-26hh-7cqf-hhc6

[jacekradko]

Bumps next to 15.5.18 to pick up the fix for GHSA-26hh-7cqf-hhc6, a high-severity (CVSS 7.5) Middleware/Proxy bypass in App Router applications via segment-prefetch routes (incomplete-fix follow-up). Mirrors #8281: updates the @clerk/nextjs devDep, the Next.js integration templates, the @clerk/msw peer floor, and the pnpm-workspace.yaml minimum-release-age exclusion. Peer range left as-is; users on the App Router should upgrade to 15.5.18 or later.

[changeset-bot]

🦋 Changeset detected

Latest commit: f684acb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clerk/nextjs	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 14, 2026 2:03am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 07ae9f6c-9265-4ef5-a699-9f0feb3246ab

📥 Commits

Reviewing files that changed from the base of the PR and between 2de5760 and f684acb.

📒 Files selected for processing (2)

• .changeset/nextjs-security-update-15-5-18.md
• integration/templates/next-cache-components/package.json

✅ Files skipped from review due to trivial changes (2)

• .changeset/nextjs-security-update-15-5-18.md
• integration/templates/next-cache-components/package.json

---

📝 Walkthrough

Walkthrough

This pull request adds a changeset for a Next.js security fix (GHSA-26hh-7cqf-hhc6), bumps Next.js in multiple integration templates (including a 16.2.6 bump for cache-components), tightens package constraints (packages/msw peerDependency and packages/nextjs devDependency), and updates pnpm-workspace.yaml's excluded Next.js entry to 15.5.18.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: updating Next.js to patched versions to address a specific security vulnerability (GHSA-26hh-7cqf-hhc6).
Description check	✅ Passed	The description provides relevant context about the security fix, references the GHSA ID and CVSS score, explains the affected versions, and mirrors a previous PR with similar updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8547

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8547

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8547

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8547

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8547

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8547

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8547

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8547

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8547

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8547

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8547

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8547

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8547

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8547

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8547

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8547

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8547

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8547

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8547

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8547

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8547

commit: f684acb