Changelog

Notable changes to the Bulwark SDKs and platform, newest first. SDK packages follow Semantic Versioning.

@bulwarkauth/nextjs 0.4.1 — 2026-06-05

Fixed — installable in downstream pnpm monorepos. 0.4.0 was published in a way that left pnpm's workspace:* protocol in the package's peerDependencies, which could fail to resolve on a clean --frozen-lockfile install under pnpm's isolated linker (surfacing as Module not found: '@bulwarkauth/nextjs' in a consumer build). Republished with real version ranges. No behavior change from 0.4.0 — if 0.4.0 installed fine for you, 0.4.1 is identical; if it didn't, upgrade to ^0.4.1.

@bulwarkauth/nextjs 0.4.0 — 2026-06-05

Fixed — sessions no longer expire at the access-token TTL.

The Next.js middleware previously redirected to the login page as soon as the short-lived access token (~15 min) lapsed, ignoring the longer-lived refresh token. On hard navigations, SSR, and idle-then-return this capped every session at the access-token lifetime even though the refresh/session TTL is 7 days.

createBulwarkMiddleware now silently refreshes the session: when the bulwark_token cookie is missing or expired it exchanges the bulwark_refresh cookie at POST {bulwarkApiUrl}/api/v1/auth/refresh, writes the rotated token pair back onto the response, and lets the request continue. It only redirects when no valid session can be recovered (and clears stale cookies when it does).

• Requires bulwarkApiUrl in the middleware config — see the Next.js SDK reference.
• The middleware is now async (Promise<NextResponse>) — backward-compatible with Next.js, but await it in any custom wrapper.

To adopt: upgrade to @bulwarkauth/nextjs@^0.4.0 and ensure your middleware.ts passes bulwarkApiUrl.