[vercel-gh-bot-4]

• Clerk Core 3 breaking changes: "Minimum Next.js version: 15.2.3" → "Minimum Next.js version: 15.2.8 (or 16.0.10 on Next.js 16); later 15.x minors need their patched releases too (15.3.8+, 15.4.10+, 15.5.9+)".
  • Clerk published a correction for this exact guidance at https://raw.githubusercontent.com/clerk/javascript/main/packages/upgrade/CHANGELOG.md (@clerk/upgrade 2.0.8, PR fix(upgrade): correct the Next.js minimum in the Core 3 guidance clerk/javascript#9790): "requires Next.js 15.2.8 or later, or 16.0.10 or later on Next.js 16, not 15.2.3".
  • The package that ships sets a patch floor for each minor. @clerk/nextjs 7.0.0 and 7.9.12 (latest) both declare peerDependencies.next as ^15.2.8 || ^15.3.8 || ^15.4.10 || ^15.5.9 || ^15.6.0-0 || ^16.0.10 || ^16.1.0-0.
  • With the old line, an agent on Next.js 15.2.3–15.2.7, 15.3.0–15.3.7, 15.4.0–15.4.9, 15.5.0–15.5.8, or 16.0.0–16.0.9 would treat its version as supported and then hit a peer dependency conflict.

Verification

run_plugin_checks passed every step: build, typecheck, validate, and test (1079 pass, 0 fail).

Test updates

None.

Not changed

• Clerk's own Core 3 upgrade guide (https://clerk.com/docs/guides/development/upgrading/upgrade-guides/core-3) still says 15.2.3. That page is behind the package and behind Clerk's correction in #9790.
• Sign in with Vercel endpoints (https://vercel.com/oauth/authorize, https://api.vercel.com/login/oauth/token), PKCE/state/nonce, and token lifetimes (1 hour access, 30-day rotating refresh) all match https://vercel.com/docs/sign-in-with-vercel/authorization-server-api (last_updated 2026-08-21) and /tokens. The link checker flags the token endpoint as not a doc page; it is an API endpoint, not a link.
• KMS: the signJWT result shape, signToken being deprecated, and 0.3.0+ all match https://vercel.com/docs/kms/ts-sdk-reference (2026-09-16) and the @vercel/kms CHANGELOG. The JWKS URL https://kms.vercel.com/<issuerId>/jwks.json matches the authorization-server-api page. It is an API URL, not a doc page.
• Passport: Enterprise plan and GA in July 2026 match the GA changelog and https://vercel.com/docs/passport (2026-09-21).

Opened automatically by the vercel-plugin drift agent. Review before merge.

---

Drift scan update 2026-10-15

• Better Auth plugin table: "Third-party tokens via Vercel Connect | genericOAuth + connect from @vercel/connect/betterauth | —" says the adapter is for third-party tokens and implies genericOAuth comes from @vercel/connect/betterauth. Corrected to "Sign in through a Vercel Connect connector | genericOAuth from better-auth/plugins/generic-oauth + connect from @vercel/connect/betterauth | — (v1.7 signs in with authClient.signIn.social; genericOAuthClient only exists on v1.6 and earlier)". Source: https://vercel.com/docs/connect/frameworks/better-auth (last_updated 2026-09-18): "The @vercel/connect/betterauth adapter lets your application sign users in through a Vercel Connect connector." The page imports genericOAuth from 'better-auth/plugins/generic-oauth'. Its client step (genericOAuthClient, signIn.oauth2) matches better-auth 1.6. In better-auth 1.7.x (latest 1.7.9), genericOAuthClient is gone and generic OAuth providers use signIn.social, so the Client column stays — with a v1.6 note. The shipped @vercel/connect 2.5.2 dist/betterauth/index.d.ts exports only connect and ConnectError, not genericOAuth.
• Cross-References: "Third-party OAuth tokens through Better Auth (@vercel/connect/betterauth)" now reads as a sign-in adapter, and the line notes that provider API tokens use getToken(). Same page: "Use getToken() from @vercel/connect when your server needs a scoped token for a provider API. Do not send the access token stored by Better Auth's generic OAuth account to the provider API." The vercel-connect skill already describes @vercel/connect/betterauth as sign-in.

Verification

run_plugin_checks: build, typecheck, validate, and test all passed (1079 tests pass, 0 fail).

Test updates

None.

Not changed

• The Clerk, Descope, and Auth0 sections are checked only against their published npm packages (@clerk/nextjs 7.9.15, @descope/nextjs-sdk 0.16.13). Their docs sites are outside the Vercel docs estate. The Clerk "Minimum Next.js version: 15.2.3" line is a Core 3 (March 2026) note. The current @clerk/nextjs peer range starts at ^15.2.8. I left the line alone.
• check_links flagged https://api.vercel.com/login/oauth/token and https://kms.vercel.com/. Both are API endpoints that the Sign in with Vercel and KMS docs document, not doc pages, so they are not dead links.
• The KMS docs label the product Beta ("Key Management Service (Beta) is available on all plans"). The skill doesn't give a status, and I didn't add one.

Opened automatically by the vercel-plugin drift agent. Review before merge.

---

Update (@molebox)

The 2026-10-15 force-push dropped the Clerk change described in the first section. It is restored in 6574712: "Minimum Next.js version: 15.2.8 (or 16.0.10 on Next.js 16); later 15.x minors need their patched releases too (15.3.8+, 15.4.10+, 15.5.9+)". Re-checked against @clerk/nextjs@7.9.17 (latest), whose peerDependencies.next is ^15.2.8 || ^15.3.8 || ^15.4.10 || ^15.5.9 || ^15.6.0-0 || ^16.0.10 || ^16.1.0-0, and Clerk's upgrade CHANGELOG (clerk/javascript#9790). The "Not changed" note that says the line was left alone is superseded. tests/auth-skill.test.ts and validate pass.