PatchVault › Errors › Supabase auth-helpers → @supabase/ssr
npm warn deprecated @supabase/auth-helpers-nextjs@0.10.0: This package is now deprecated - please use the @supabase/ssr package instead.
npm prints this on every install because your project (or a dependency) still pulls in the Auth Helpers package, which Supabase has replaced with @supabase/ssr. Newer releases (0.15.0) carry the shorter notice "Package no longer supported."
Check your code free (runs in your browser)
The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.
Or scan your whole repo locally (free, stdlib Python, read-only):
python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/supabase-ssr-scan.py) .
Get the Supabase auth-helpers → @supabase/ssr auto-fixer: $9 one-time
Why it happens
The auth-helpers packages are in maintenance mode and no longer receive fixes. Supabase recommends not mixing auth-helpers and @supabase/ssr in one app, because the two manage the session cookies differently.
Manual fix
npm uninstall @supabase/auth-helpers-nextjs
npm install @supabase/ssr @supabase/supabase-js
# then replace the clients:
# createClientComponentClient -> createBrowserClient
# createServerComponentClient -> createServerClient
# createRouteHandlerClient -> createServerClient
# createMiddlewareClient -> createServerClient
Verify
Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.
Sources
Related errors
- @supabase/ssr get/set/remove cookies deprecated
- Supabase "Invalid Refresh Token: Refresh Token Not Found"
- Supabase "Invalid Refresh Token: Session Expired"
- Cookies can only be modified in a Server Action (Supabase)
- Supabase getSession() "could be insecure" warning
Full guide and free terminal scanner: Supabase auth-helpers → @supabase/ssr. Last checked 2026-10-31.