security: Upgrade @clerk/nextjs to 6.39.2 (GHSA-vqx2-fgx2-5wq9) (#97)

* ci: use centralized vuln remediation workflow from infra

Made-with: Cursor

* ci: replace custom config with socket.yml

Made-with: Cursor

* ci: point vuln remediation at kernel/security-workflows

Made-with: Cursor

* Upgrade @clerk/nextjs to 6.39.2 to fix middleware route protection bypass

Addresses GHSA-vqx2-fgx2-5wq9 (CVSS 9.1): createRouteMatcher could be
bypassed via percent-encoded URLs and double-slash path manipulation.

Our middleware uses the safe allowlist (isPublicRoute) pattern so we are
not actively exploitable, but the underlying createPathMatcher now
normalizes paths with decodeURI and slash collapsing — upgrading as
recommended by Clerk.

Made-with: Cursor

Author: ulziibay-kernel

.github/workflows/vuln-remediation.yml

@@ -0,0 +1,17 @@
+name: Vulnerability Remediation
+
+on:
+  schedule:
+    - cron: '0 3 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  remediate:
+    uses: kernel/security-workflows/.github/workflows/vuln-remediation.yml@main
+    with:
+      setup-bun: true
+    secrets: inherit

bun.lock

@@ -30,7 +30,7 @@
   },
   "dependencies": {
     "@clerk/mcp-tools": "^0.1.1",
-    "@clerk/nextjs": "^6.32.0",
+    "@clerk/nextjs": "^6.39.2",
     "@clerk/themes": "^2.4.19",
     "@mcp-ui/server": "^5.10.0",
     "@modelcontextprotocol/sdk": "1.26.0",

package.json

@@ -0,0 +1 @@
+version: 2