fix(nextjs): remove unnecessary csrfToken dependency from useCallback

.changeset/fix-usecallback-csrftoken-dep.md

@@ -0,0 +1,11 @@
+---
+"@csrf-armor/nextjs": patch
+---
+
+fix(react): remove unnecessary `csrfToken` dependency from `useCallback`
+
+`secureFetch` previously listed `csrfToken` in its `useCallback` dependency array, causing the function reference to change every time the token updated. This made the `CsrfContextValue` unstable and triggered unnecessary re-renders in any component consuming `useCsrf()`.
+
+The token equality check (`newToken !== csrfToken`) was also redundant because React's `setState` already bails out for identical primitive values. Removing both the dependency and the comparison fixes the re-render issue without changing behavior.
+
+Fixes #53

packages/nextjs/src/client/react.tsx

@@ -169,13 +169,13 @@ export function CsrfProvider({
       const headerName = config?.headerName ?? 'x-csrf-token';
       const newToken = response.headers.get(headerName);
 
-      if (newToken && newToken !== csrfToken) {
+      if (newToken) {
         setCsrfToken(newToken);
       }
 
       return response;
     },
-    [config, csrfToken]
+    [config]
   );
 
   const value = useMemo<CsrfContextValue>(