chore: Bump deps & fix IP lookup

Author: davidmytton

app/api/auth/[...nextauth]/route.ts

@@ -30,8 +30,9 @@ const aj = arcjet
 // Protect the sensitive actions e.g. login, signup, etc with Arcjet
 const ajProtectedPOST = async (req: NextRequest) => {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   const decision = await aj.protect(req, { fingerprint: userIp });
 
   if (decision.isDenied()) {

app/attack/test/route.ts

@@ -16,8 +16,9 @@ const aj = arcjet.withRule(
 
 export async function GET(req: NextRequest) {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp });

app/bots/test/route.ts

@@ -26,8 +26,9 @@ const aj = arcjet
 
 export async function GET(req: NextRequest) {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp });

app/rate-limiting/test/route.ts

@@ -46,8 +46,9 @@ export async function POST(req: NextRequest) {
   console.log("Session: ", session);
 
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
 
   // Use the user ID if the user is logged in, otherwise use the IP address
   const fingerprint = session?.user?.id ?? userIp;

app/sensitive-info/test/route.ts

@@ -26,8 +26,9 @@ const aj = arcjet
 
 export async function POST(req: NextRequest) {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp });

app/signup/test/route.ts

@@ -57,8 +57,9 @@ export async function POST(req: NextRequest) {
   const { email } = data.data;
 
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp, email });

next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.