ci(repo): Version packages (#9206)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: clerk-cookie

.changeset/floppy-buckets-help.md

@@ -1,5 +1,51 @@
 # @clerk/astro
 
+## 4.0.0
+
+### Major Changes
+
+- Add support for Astro 7 and drop support for Astro 4. If you are still on Astro 4, follow the [Astro upgrade guide](https://docs.astro.build/en/guides/upgrade-to/v6/) to upgrade your project before updating `@clerk/astro`. ([#8974](https://github.com/clerk/javascript/pull/8974)) by [@wobsoriano](https://github.com/wobsoriano)
+
+- Remove `createRouteMatcher` from `@clerk/astro/server`. Use resource-based auth checks instead: move auth checks into each Astro page, API route, or server-side handler that accesses protected data. Middleware-based auth checks rely on path matching, which can diverge from how Astro routes requests and leave protected resources reachable. ([#8974](https://github.com/clerk/javascript/pull/8974)) by [@wobsoriano](https://github.com/wobsoriano)
+
+  ```ts
+  import type { APIRoute } from 'astro';
+
+  export const GET: APIRoute = ({ locals }) => {
+    const { userId } = locals.auth();
+
+    if (!userId) {
+      return new Response('Unauthorized', { status: 401 });
+    }
+
+    return Response.json({ userId });
+  };
+  ```
+
+  If you want to hand this work to a coding agent, use this migration prompt:
+
+  ```md
+  Migrate my Astro project away from Clerk's removed `createRouteMatcher` API.
+
+  1. Open `src/middleware.ts` (or `src/middleware.js`) and find every matcher created
+     with `createRouteMatcher` from `@clerk/astro/server`, along with the middleware
+     logic that uses it (returning 401s, calling `auth().redirectToSignIn()`, etc.).
+  2. For every route those matchers protected, move the auth check into the resource itself:
+     - In `.astro` pages, add this to the frontmatter:
+       const { userId, redirectToSignIn } = Astro.locals.auth();
+       if (!userId) return redirectToSignIn();
+     - In API routes and server handlers, add this at the top of the handler:
+       const { userId } = locals.auth();
+       if (!userId) return new Response('Unauthorized', { status: 401 });
+     - Keep any role or permission checks (`auth().has(...)`) with the resource as well.
+  3. Remove the `createRouteMatcher` import and calls from the middleware. Keep
+     `clerkMiddleware()` itself. Middleware logic unrelated to auth protection
+     (locale redirects, headers, etc.) may stay, using plain `URL`/pathname checks.
+  4. Make sure every page and endpoint previously covered by a matcher pattern
+     (including glob patterns like `/dashboard(.*)`) now has its own check, then
+     verify the project builds.
+  ```
+
 ## 3.4.20
 
 ### Patch Changes

.changeset/major-astro-remove-route-matcher.md

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/astro",
-  "version": "3.4.20",
+  "version": "4.0.0",
   "description": "Clerk SDK for Astro",
   "keywords": [
     "auth",

.changeset/swift-plums-cover.md

@@ -1,5 +1,11 @@
 # Change Log
 
+## 7.5.22
+
+### Patch Changes
+
+- Remove the redundant `https://*.client.protect.clerk.com` source from CSP headers generated by `clerkMiddleware()`. ([#9207](https://github.com/clerk/javascript/pull/9207)) by [@mwickett](https://github.com/mwickett)
+
 ## 7.5.21
 
 ### Patch Changes

.changeset/typedoc-multi-example-double-comma.md

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/nextjs",
-  "version": "7.5.21",
+  "version": "7.5.22",
   "description": "Clerk SDK for NextJS",
   "keywords": [
     "clerk",