I am looking for clarification on the v3 nextjs-auth0 package with Next.js 15. It lists v15 in the lockfile but the README specifically states that 15 support requires v4 of the package. Can someone please help me understand what is correct? The auth0 package currently blocks upgrades for us.
Thanks!
Welcome to the Auth0 Community!
Allow me some time to investigate this discrepancy you mentioned and I will come back with further clarification on the matter!
Kind Regards,
Nik
Hi again!
You must upgrade to @auth0/nextjs-auth0 v4 to support Next.js 15.
While your package manager might resolve Next.js 15 as a peer dependency in v3 without throwing an installation error, the v3 SDK will critically fail at runtime in a Next.js 15 environment.
Let’s look at exactly why this strict version requirement exists and why the lockfile might be sending mixed signals:
In Next.js 15, Vercel introduced a massive architectural breaking change to dynamic APIs. Functions that read the incoming request state—specifically cookies() and headers() —were changed from synchronous functions to asynchronous functions.
The @auth0/nextjs-auth0 v3 SDK was written for Next.js 13 and 14. Under the hood, it heavily relies on calling cookies() and headers() synchronously to manage the encrypted session state. If you try to run v3 on Next.js 15, the SDK will attempt to read a cookie synchronously, receive an unresolved Promise instead of a string, and your authentication flow will crash.
During the Next.js 15 Release Candidate (RC) phase, peer dependency ranges are sometimes broadened across the ecosystem (e.g., ^13.0.0 || ^14.0.0 || ^15.0.0 ) to allow for initial compatibility testing without npm throwing strict peer dependency errors. This is likely why you see v15 referenced in the lockfile tree. However, successful installation does not equal runtime compatibility.
If you have any other questions let me know!
Kind Regards,
Nik