Skip to content

chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587

Merged
wobsoriano merged 22 commits into
mainfrom
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged

chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom
bruno/user-5312-deprecate-update-user-metadata-fields

Conversation

@brunol95

@brunol95brunol95 commented May 18, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Description

  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated
  • update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

@changeset-bot

changeset-botBot commented May 18, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d582a57

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented May 18, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm

Request Review

@brunol95brunol95 changed the title deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai

coderabbitaiBot commented May 18, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Comment @coderabbitai help to get the list of available commands and usage tips.

@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed the bruno/user-5312-deprecate-update-user-metadata-fields branch from 640692b to 16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new

pkg-pr-newBot commented May 18, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57

@brunol95brunol95 changed the title chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95 changed the title feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95 requested review from a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano requested changes May 19, 2026
View reviewed changes

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.

Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts

Comment thread.changeset/deprecate-update-user-metadata.md

@wobsorianowobsorianoMay 19, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼

  1. for backend
  2. for clerk-js and shared

@brunol95brunol95May 20, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Comment threadpackages/clerk-js/src/core/resources/User.ts
});
}

const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);

@wobsorianowobsorianoMay 19, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.

Correct me if Im wrong 😄

@brunol95brunol95May 20, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:

  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.

@brunol95brunol95May 20, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!

@brunol95
brunol95 requested a review from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano requested changes May 20, 2026
View reviewed changes

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests

Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md Outdated
Comment thread.changeset/deprecate-update-user-metadata.md Outdated
Comment threadintegration/tests/unsafeMetadata.test.ts Outdated
Comment threadpackages/clerk-js/src/utils/mergePatch.ts Outdated
Comment threadpackages/clerk-js/src/utils/mergePatch.ts Outdated
Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot reviewed May 20, 2026
View reviewed changes

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237

📥 Commits

Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.

📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md

Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md Outdated
wobsoriano
wobsoriano approved these changes May 20, 2026
View reviewed changes

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!

I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.

Approving!

@github-actions

github-actionsBot commented May 27, 2026

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by snapi on 2026-05-27T20:10:11.894Z

Summary

MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0

🤖 This report was reviewed by claude-sonnet-4-6.

@clerk/shared

Version: 4.13.1 → 4.13.1
Recommended bump: MINOR

Subpath ./types

🟡 Non-breaking Changes (1)

Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };

Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}

🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.

Report generated by snapi

@github-actions

github-actionsBot commented Jun 9, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-11T16:36:14.252Z

Summary

MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0

🤖 This report was reviewed by claude-sonnet-4-6.

Note
Break Check could not snapshot 3 subpaths; the diff below excludes them.

  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress

@clerk/shared

Current version: 4.17.0
Recommended bump: MINOR → 4.18.0

Subpath ./types

🟡 Non-breaking Changes (1)

Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };

Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…

🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.

Report generated by Break Check

Last ran on d582a57.

@brunol95brunol95 changed the title feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano enabled auto-merge (squash) June 11, 2026 18:31
@wobsoriano
wobsoriano merged commit b5fa9f6 into mainJun 11, 2026
47 checks passed
@wobsoriano
wobsoriano deleted the bruno/user-5312-deprecate-update-user-metadata-fields branch June 11, 2026 18:31
@clerk-cookieclerk-cookie mentioned this pull request Jun 11, 2026
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request Jul 1, 2026
Merged
This was referenced Jul 11, 2026
Merged
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request Aug 1, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees

No one assigned

Labels

backendclerk-jsdo not mergeintegration

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
chore(backend, clerk-js): Deprecate metadata updates in user update methods by brunol95 · Pull Request #8587 · clerk/javascript · GitHub
Skip to content
chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587
Merged
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged
chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Conversation
@brunol95
@brunol95brunol95
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
  •  update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d582a57
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm
Request Review
@brunol95brunol95
changed the title
deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai
coderabbitaiBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
📝 Walkthrough
Walkthrough
This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed
the
bruno/user-5312-deprecate-update-user-metadata-fields
branch
from
640692b to
16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new
pkg-pr-newBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57
@brunol95brunol95
changed the title
chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95
changed the title
feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95
requested review from
a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano
requested changes
May 19, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.
Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts
Comment thread.changeset/deprecate-update-user-metadata.md
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼
  1. for backend
  2. for clerk-js and shared
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done
Comment threadpackages/clerk-js/src/core/resources/User.ts
 });
 }

 const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.
Correct me if Im wrong 😄
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:
  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!
@brunol95
brunol95
requested a review
from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano
requested changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

Comment thread.changeset/deprecate-update-user-metadata.md
Outdated

Comment threadintegration/tests/unsafeMetadata.test.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot
reviewed
May 20, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.

🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
  •  Push a commit to this branch (recommended)
  •  Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237
📥 Commits
Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.
📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

wobsoriano
wobsoriano
approved these changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!
I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.
Approving!
@github-actions
github-actionsBot
commented
May 27, 2026

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by snapi on 2026-05-27T20:10:11.894Z
Summary
MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
@clerk/shared
Version: 4.13.1 → 4.13.1
Recommended bump: MINOR
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}
🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.
Report generated by snapi
@github-actions
github-actionsBot
commented
Jun 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-11T16:36:14.252Z
Summary
MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
Note

Break Check could not snapshot 3 subpaths; the diff below excludes them.
  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress
@clerk/shared
Current version: 4.17.0
Recommended bump: MINOR → 4.18.0
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…
🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.
Report generated by Break Check
Last ran on d582a57.
@brunol95brunol95
changed the title
feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano
enabled auto-merge (squash)
June 11, 2026 18:31
@wobsoriano
wobsoriano
merged commit b5fa9f6
into
mainJun 11, 2026

47 checks passed

@wobsoriano
wobsoriano
deleted the

bruno/user-5312-deprecate-update-user-metadata-fields

branch
June 11, 2026 18:31
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 11, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 1, 2026
 Merged


This was referenced Jul 11, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 1, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

backendclerk-jsdo not mergeintegration

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(backend, clerk-js): Deprecate metadata updates in user update methods by brunol95 · Pull Request #8587 · clerk/javascript · GitHub
Skip to content
chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587
Merged
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged
chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Conversation
@brunol95
@brunol95brunol95
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
  •  update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d582a57
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm
Request Review
@brunol95brunol95
changed the title
deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai
coderabbitaiBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
📝 Walkthrough
Walkthrough
This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed
the
bruno/user-5312-deprecate-update-user-metadata-fields
branch
from
640692b to
16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new
pkg-pr-newBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57
@brunol95brunol95
changed the title
chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95
changed the title
feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95
requested review from
a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano
requested changes
May 19, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.
Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts
Comment thread.changeset/deprecate-update-user-metadata.md
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼
  1. for backend
  2. for clerk-js and shared
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done
Comment threadpackages/clerk-js/src/core/resources/User.ts
 });
 }

 const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.
Correct me if Im wrong 😄
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:
  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!
@brunol95
brunol95
requested a review
from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano
requested changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

Comment thread.changeset/deprecate-update-user-metadata.md
Outdated

Comment threadintegration/tests/unsafeMetadata.test.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot
reviewed
May 20, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.

🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
  •  Push a commit to this branch (recommended)
  •  Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237
📥 Commits
Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.
📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

wobsoriano
wobsoriano
approved these changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!
I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.
Approving!
@github-actions
github-actionsBot
commented
May 27, 2026

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by snapi on 2026-05-27T20:10:11.894Z
Summary
MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
@clerk/shared
Version: 4.13.1 → 4.13.1
Recommended bump: MINOR
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}
🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.
Report generated by snapi
@github-actions
github-actionsBot
commented
Jun 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-11T16:36:14.252Z
Summary
MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
Note

Break Check could not snapshot 3 subpaths; the diff below excludes them.
  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress
@clerk/shared
Current version: 4.17.0
Recommended bump: MINOR → 4.18.0
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…
🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.
Report generated by Break Check
Last ran on d582a57.
@brunol95brunol95
changed the title
feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano
enabled auto-merge (squash)
June 11, 2026 18:31
@wobsoriano
wobsoriano
merged commit b5fa9f6
into
mainJun 11, 2026

47 checks passed

@wobsoriano
wobsoriano
deleted the

bruno/user-5312-deprecate-update-user-metadata-fields

branch
June 11, 2026 18:31
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 11, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 1, 2026
 Merged


This was referenced Jul 11, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 1, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

backendclerk-jsdo not mergeintegration

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(backend, clerk-js): Deprecate metadata updates in user update methods by brunol95 · Pull Request #8587 · clerk/javascript · GitHub
Skip to content
chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587
Merged
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged
chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Conversation
@brunol95
@brunol95brunol95
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
  •  update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d582a57
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm
Request Review
@brunol95brunol95
changed the title
deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai
coderabbitaiBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
📝 Walkthrough
Walkthrough
This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed
the
bruno/user-5312-deprecate-update-user-metadata-fields
branch
from
640692b to
16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new
pkg-pr-newBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57
@brunol95brunol95
changed the title
chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95
changed the title
feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95
requested review from
a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano
requested changes
May 19, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.
Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts
Comment thread.changeset/deprecate-update-user-metadata.md
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼
  1. for backend
  2. for clerk-js and shared
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done
Comment threadpackages/clerk-js/src/core/resources/User.ts
 });
 }

 const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.
Correct me if Im wrong 😄
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:
  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!
@brunol95
brunol95
requested a review
from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano
requested changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

Comment thread.changeset/deprecate-update-user-metadata.md
Outdated

Comment threadintegration/tests/unsafeMetadata.test.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot
reviewed
May 20, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.

🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
  •  Push a commit to this branch (recommended)
  •  Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237
📥 Commits
Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.
📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

wobsoriano
wobsoriano
approved these changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!
I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.
Approving!
@github-actions
github-actionsBot
commented
May 27, 2026

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by snapi on 2026-05-27T20:10:11.894Z
Summary
MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
@clerk/shared
Version: 4.13.1 → 4.13.1
Recommended bump: MINOR
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}
🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.
Report generated by snapi
@github-actions
github-actionsBot
commented
Jun 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-11T16:36:14.252Z
Summary
MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
Note

Break Check could not snapshot 3 subpaths; the diff below excludes them.
  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress
@clerk/shared
Current version: 4.17.0
Recommended bump: MINOR → 4.18.0
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…
🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.
Report generated by Break Check
Last ran on d582a57.
@brunol95brunol95
changed the title
feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano
enabled auto-merge (squash)
June 11, 2026 18:31
@wobsoriano
wobsoriano
merged commit b5fa9f6
into
mainJun 11, 2026

47 checks passed

@wobsoriano
wobsoriano
deleted the

bruno/user-5312-deprecate-update-user-metadata-fields

branch
June 11, 2026 18:31
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 11, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 1, 2026
 Merged


This was referenced Jul 11, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 1, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

backendclerk-jsdo not mergeintegration

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
chore(backend, clerk-js): Deprecate metadata updates in user update methods by brunol95 · Pull Request #8587 · clerk/javascript · GitHub
Skip to content
chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587
Merged
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged
chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Conversation
@brunol95
@brunol95brunol95
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
  •  update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d582a57
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm
Request Review
@brunol95brunol95
changed the title
deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai
coderabbitaiBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
📝 Walkthrough
Walkthrough
This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed
the
bruno/user-5312-deprecate-update-user-metadata-fields
branch
from
640692b to
16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new
pkg-pr-newBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57
@brunol95brunol95
changed the title
chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95
changed the title
feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95
requested review from
a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano
requested changes
May 19, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.
Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts
Comment thread.changeset/deprecate-update-user-metadata.md
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼
  1. for backend
  2. for clerk-js and shared
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done
Comment threadpackages/clerk-js/src/core/resources/User.ts
 });
 }

 const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.
Correct me if Im wrong 😄
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:
  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!
@brunol95
brunol95
requested a review
from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano
requested changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

Comment thread.changeset/deprecate-update-user-metadata.md
Outdated

Comment threadintegration/tests/unsafeMetadata.test.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot
reviewed
May 20, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.

🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
  •  Push a commit to this branch (recommended)
  •  Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237
📥 Commits
Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.
📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

wobsoriano
wobsoriano
approved these changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!
I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.
Approving!
@github-actions
github-actionsBot
commented
May 27, 2026

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by snapi on 2026-05-27T20:10:11.894Z
Summary
MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
@clerk/shared
Version: 4.13.1 → 4.13.1
Recommended bump: MINOR
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}
🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.
Report generated by snapi
@github-actions
github-actionsBot
commented
Jun 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-11T16:36:14.252Z
Summary
MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
Note

Break Check could not snapshot 3 subpaths; the diff below excludes them.
  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress
@clerk/shared
Current version: 4.17.0
Recommended bump: MINOR → 4.18.0
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…
🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.
Report generated by Break Check
Last ran on d582a57.
@brunol95brunol95
changed the title
feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano
enabled auto-merge (squash)
June 11, 2026 18:31
@wobsoriano
wobsoriano
merged commit b5fa9f6
into
mainJun 11, 2026

47 checks passed

@wobsoriano
wobsoriano
deleted the

bruno/user-5312-deprecate-update-user-metadata-fields

branch
June 11, 2026 18:31
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 11, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 1, 2026
 Merged


This was referenced Jul 11, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 1, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

backendclerk-jsdo not mergeintegration

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(backend, clerk-js): Deprecate metadata updates in user update methods by brunol95 · Pull Request #8587 · clerk/javascript · GitHub
Skip to content
chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587
Merged
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged
chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Conversation
@brunol95
@brunol95brunol95
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
  •  update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d582a57
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm
Request Review
@brunol95brunol95
changed the title
deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai
coderabbitaiBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
📝 Walkthrough
Walkthrough
This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed
the
bruno/user-5312-deprecate-update-user-metadata-fields
branch
from
640692b to
16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new
pkg-pr-newBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57
@brunol95brunol95
changed the title
chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95
changed the title
feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95
requested review from
a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano
requested changes
May 19, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.
Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts
Comment thread.changeset/deprecate-update-user-metadata.md
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼
  1. for backend
  2. for clerk-js and shared
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done
Comment threadpackages/clerk-js/src/core/resources/User.ts
 });
 }

 const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.
Correct me if Im wrong 😄
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:
  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!
@brunol95
brunol95
requested a review
from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano
requested changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

Comment thread.changeset/deprecate-update-user-metadata.md
Outdated

Comment threadintegration/tests/unsafeMetadata.test.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot
reviewed
May 20, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.

🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
  •  Push a commit to this branch (recommended)
  •  Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237
📥 Commits
Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.
📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

wobsoriano
wobsoriano
approved these changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!
I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.
Approving!
@github-actions
github-actionsBot
commented
May 27, 2026

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by snapi on 2026-05-27T20:10:11.894Z
Summary
MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
@clerk/shared
Version: 4.13.1 → 4.13.1
Recommended bump: MINOR
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}
🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.
Report generated by snapi
@github-actions
github-actionsBot
commented
Jun 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-11T16:36:14.252Z
Summary
MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
Note

Break Check could not snapshot 3 subpaths; the diff below excludes them.
  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress
@clerk/shared
Current version: 4.17.0
Recommended bump: MINOR → 4.18.0
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…
🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.
Report generated by Break Check
Last ran on d582a57.
@brunol95brunol95
changed the title
feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano
enabled auto-merge (squash)
June 11, 2026 18:31
@wobsoriano
wobsoriano
merged commit b5fa9f6
into
mainJun 11, 2026

47 checks passed

@wobsoriano
wobsoriano
deleted the

bruno/user-5312-deprecate-update-user-metadata-fields

branch
June 11, 2026 18:31
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 11, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 1, 2026
 Merged


This was referenced Jul 11, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 1, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

backendclerk-jsdo not mergeintegration

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(backend, clerk-js): Deprecate metadata updates in user update methods by brunol95 · Pull Request #8587 · clerk/javascript · GitHub
Skip to content
chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587
Merged
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged
chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Conversation
@brunol95
@brunol95brunol95
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
  •  update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d582a57
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm
Request Review
@brunol95brunol95
changed the title
deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai
coderabbitaiBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
📝 Walkthrough
Walkthrough
This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed
the
bruno/user-5312-deprecate-update-user-metadata-fields
branch
from
640692b to
16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new
pkg-pr-newBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57
@brunol95brunol95
changed the title
chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95
changed the title
feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95
requested review from
a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano
requested changes
May 19, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.
Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts
Comment thread.changeset/deprecate-update-user-metadata.md
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼
  1. for backend
  2. for clerk-js and shared
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done
Comment threadpackages/clerk-js/src/core/resources/User.ts
 });
 }

 const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.
Correct me if Im wrong 😄
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:
  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!
@brunol95
brunol95
requested a review
from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano
requested changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

Comment thread.changeset/deprecate-update-user-metadata.md
Outdated

Comment threadintegration/tests/unsafeMetadata.test.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot
reviewed
May 20, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.

🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
  •  Push a commit to this branch (recommended)
  •  Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237
📥 Commits
Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.
📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

wobsoriano
wobsoriano
approved these changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!
I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.
Approving!
@github-actions
github-actionsBot
commented
May 27, 2026

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by snapi on 2026-05-27T20:10:11.894Z
Summary
MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
@clerk/shared
Version: 4.13.1 → 4.13.1
Recommended bump: MINOR
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}
🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.
Report generated by snapi
@github-actions
github-actionsBot
commented
Jun 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-11T16:36:14.252Z
Summary
MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
Note

Break Check could not snapshot 3 subpaths; the diff below excludes them.
  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress
@clerk/shared
Current version: 4.17.0
Recommended bump: MINOR → 4.18.0
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…
🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.
Report generated by Break Check
Last ran on d582a57.
@brunol95brunol95
changed the title
feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano
enabled auto-merge (squash)
June 11, 2026 18:31
@wobsoriano
wobsoriano
merged commit b5fa9f6
into
mainJun 11, 2026

47 checks passed

@wobsoriano
wobsoriano
deleted the

bruno/user-5312-deprecate-update-user-metadata-fields

branch
June 11, 2026 18:31
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 11, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 1, 2026
 Merged


This was referenced Jul 11, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 1, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

backendclerk-jsdo not mergeintegration

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
chore(backend, clerk-js): Deprecate metadata updates in user update methods by brunol95 · Pull Request #8587 · clerk/javascript · GitHub
Skip to content
chore(backend, clerk-js): Deprecate metadata updates in user update methods - #8587
Merged
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Jun 11, 2026
Merged
chore(backend, clerk-js): Deprecate metadata updates in user update methods#8587
wobsoriano merged 22 commits into
mainfrom 
bruno/user-5312-deprecate-update-user-metadata-fields
Conversation
@brunol95
@brunol95brunol95
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
  • deprecates metadata fields in update user methods and refactors implementation to route to dedicated metadata endpoints
  • adds a new replaceUserMetadata method
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
  •  update SUPPORTED_BAPI_VERSION and SUPPORTED_FAPI_VERSION constants
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d582a57
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 21 packages
NameType
@clerk/backendMinor
@clerk/clerk-jsPatch
@clerk/sharedPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
@clerk/chrome-extensionPatch
@clerk/expoPatch
@clerk/expo-passkeysPatch
@clerk/localizationsPatch
@clerk/mswPatch
@clerk/reactPatch
@clerk/uiPatch
@clerk/vuePatch
@clerk/swingsetPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 11, 2026 4:28pm
swingsetReadyReadyPreview, CommentJun 11, 2026 4:28pm
Request Review
@brunol95brunol95
changed the title
deprecate metadata updates in user update methodschore(clerk-js, backend):deprecate metadata updates in user update methodsMay 18, 2026
@coderabbitai
coderabbitaiBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
📝 Walkthrough
Walkthrough
This PR refactors user metadata update paths across the Clerk JavaScript SDK: it deprecates metadata parameters on updateUser/user.update, adds an RFC 7396 computeMergePatch utility, makes frontend User.update async to conditionally route unsafeMetadata via merge-patch-aware updateMetadata (short-circuiting when unchanged), splits backend updateUser into conditional PATCH (non-metadata) and PUT (metadata), and adds replaceUserMetadata for full metadata replacement. Tests and API/version constant bumps accompany the changes.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
  • clerk/javascript#8537: Introduces User.updateMetadata() on the frontend, which this PR uses as the target method for routing deprecated user.update({ unsafeMetadata }) calls.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Title check✅ PassedThe title accurately captures the main change: deprecating metadata fields in user update methods and refactoring implementation to route metadata to dedicated endpoints, which is the primary focus across the backend and clerk-js packages.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brunol95@cursoragent
deprecate metadata updates via clerkClient.users.updateUser and user.…
16fdd04
…update
Co-authored-by: Cursor <cursoragent@cursor.com>
@brunol95
brunol95force-pushed
the
bruno/user-5312-deprecate-update-user-metadata-fields
branch
from
640692b to
16fdd04CompareMay 18, 2026 19:56
@pkg-pr-new
pkg-pr-newBot
commented
May 18, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8587

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8587

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8587

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8587

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8587

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8587

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8587

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8587

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8587

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8587

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8587

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8587

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8587

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8587

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8587

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8587

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8587

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8587

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8587

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8587

commit: d582a57
@brunol95brunol95
changed the title
chore(clerk-js, backend):deprecate metadata updates in user update methodsfeat(clerk-js, backend):deprecate metadata updates in user update methodsMay 19, 2026
@brunol95brunol95
changed the title
feat(clerk-js, backend):deprecate metadata updates in user update methodsfeat(backend, clerk-js): Deprecate metadata updates in user update methodsMay 19, 2026
@brunol95
brunol95
requested review from
a team and wobsorianoMay 19, 2026 14:14
wobsoriano
wobsoriano
requested changes
May 19, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small suggestion and a question.
Also if possible, I think we should add an e2e test. We can place the test here https://github.com/clerk/javascript/blob/main/integration/tests/unsafeMetadata.test.ts
Comment thread.changeset/deprecate-update-user-metadata.md
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's split this into separate changesets so each package changelog stays focused 👍🏼
  1. for backend
  2. for clerk-js and shared
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done
Comment threadpackages/clerk-js/src/core/resources/User.ts
 });
 }

 const patch = computeMergePatch(this.unsafeMetadata, unsafeMetadata);
@wobsorianowobsorianoMay 19, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this preserve replacement semantics if this.unsafeMetadata is not fresh at the moment of the call? Touch-on-focus can refresh the user in common tab-switching flows, but user.update({ unsafeMetadata }) previously sent the caller-provided value as the full replacement regardless of local cache state. With this client-side diff, a stale local value can produce an incomplete patch, or {} and skip the request entirely.
Correct me if Im wrong 😄
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes you are right . There are two scenarios:
  1. if we execute the call to PATCH v1 /me endpoint first that returns a fresh user object. No issue here since the diff will be using the latest data.
  2. If the request is a metadata only update, then theres a chance the user object could be stale. In this case, I think we'll need to perform a reload first.
@brunol95brunol95May 20, 2026

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wobsoriano I pushed a fix. Let me know what you think!
@brunol95
brunol95
requested a review
from wobsorianoMay 20, 2026 16:03
wobsoriano
wobsoriano
requested changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple more comments, but this is looking good! Thank you for resolving the other requests
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

Comment thread.changeset/deprecate-update-user-metadata.md
Outdated

Comment threadintegration/tests/unsafeMetadata.test.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/utils/mergePatch.ts
Outdated

Comment threadpackages/clerk-js/src/core/resources/User.ts
@brunol95
fix: isPlainObject rejects Date,Map, class interfaces
926d666
- update changesets
- refactor to use dequal pkg
- refactor tests to remove type assertion
coderabbitai[bot]
coderabbitaiBot
reviewed
May 20, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/route-unsafe-metadata-to-merge-endpoint.md:
- Line 13: Fix the broken inline code span by adding the missing opening
backtick so the fragment around user.update({ unsafeMetadata }) is rendered as
an inline code span; locate the sentence containing "user.update({
unsafeMetadata })` continues to work for now..." and prepend a backtick before
user.update to produce `user.update({ unsafeMetadata })` continues to work for
now and preserves its existing full-replacement behavior.

🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
  •  Push a commit to this branch (recommended)
  •  Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 38c3faa6-142f-4cc3-b7e7-b42ea737c237
📥 Commits
Reviewing files that changed from the base of the PR and between aebfef5 and 926d666.
📒 Files selected for processing (5)
  • .changeset/deprecate-update-user-metadata.md
  • .changeset/route-unsafe-metadata-to-merge-endpoint.md
  • integration/tests/unsafeMetadata.test.ts
  • packages/clerk-js/src/utils/__tests__/mergePatch.test.ts
  • packages/clerk-js/src/utils/mergePatch.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/deprecate-update-user-metadata.md
Comment thread.changeset/route-unsafe-metadata-to-merge-endpoint.md
Outdated

wobsoriano
wobsoriano
approved these changes
May 20, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the comments!
I think the main tradeoff I see is that mixed metadata + non-metadata updates are now split into two requests, so they are no longer atomic if the second request fails.
Approving!
@github-actions
github-actionsBot
commented
May 27, 2026

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by snapi on 2026-05-27T20:10:11.894Z
Summary
MetricCount
Packages analyzed6
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
@clerk/shared
Version: 4.13.1 → 4.13.1
Recommended bump: MINOR
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams(reclassified from breaking)
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Breaking change in type alias UpdateUserParams: Type changed: Partial<SnakeToCamel<UpdateUserJSON>> → Omit<Partial<SnakeToCamel<UpdateUserJSON>>,'unsafeMetadata'>&{unsafeMetadata?:UserUnsafeMetadata;}
🤖 AI review (confidence: 75%): The change narrows the unsafeMetadata field from whatever SnakeToCamel<UpdateUserJSON> produces (likely Record<string, unknown> or similar) to UserUnsafeMetadata. If UserUnsafeMetadata is a narrower type than what SnakeToCamel<UpdateUserJSON>['unsafeMetadata'] resolves to, callers passing values that were previously valid but no longer satisfy UserUnsafeMetadata would break. However, UserUnsafeMetadata is the canonical type for this field across the Clerk API, and callers are already expected to pass UserUnsafeMetadata-shaped values. The structural change is effectively making the type more explicit/accurate rather than narrowing it in a way that breaks real consumer code.
Report generated by snapi
@github-actions
github-actionsBot
commented
Jun 9, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-11T16:36:14.252Z
Summary
MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0
🤖 This report was reviewed by claude-sonnet-4-6.
Note

Break Check could not snapshot 3 subpaths; the diff below excludes them.
  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress
@clerk/shared
Current version: 4.17.0
Recommended bump: MINOR → 4.18.0
Subpath ./types
🟡 Non-breaking Changes (1)
Modified: UpdateUserParams
- type UpdateUserParams = Partial<SnakeToCamel<UpdateUserJSON>>;+ type UpdateUserParams = Omit<Partial<SnakeToCamel<UpdateUserJSON>>, 'unsafeMetadata'> & {+ unsafeMetadata?: UserUnsafeMetadata;+ };
Static analyzer: Breaking change in type alias UpdateUserParams: Type changed: !Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>> → !Omit:type<!Partial:type<import("@clerk/shared").SnakeToCamel<import("@clerk/shared").~UpdateUserJSON>>,'unsafeMetadata…
🤖 AI review (reclassified as non-breaking) (85%): The change replaces unsafeMetadata?: unknown (from SnakeToCamel<UpdateUserJSON>) with unsafeMetadata?: UserUnsafeMetadata; since UpdateUserParams is used only as a function input parameter (update(params: UpdateUserParams)), narrowing an input property's type could in principle break callers passing a wider value, but UserUnsafeMetadata is the canonical metadata type consumers already use for this field, and the field remains optional — consumers passing a correctly-typed UserUnsafeMetadata value are unaffected. The structural shape is compatible for typical well-typed consumers.
Report generated by Break Check
Last ran on d582a57.
@brunol95brunol95
changed the title
feat(backend, clerk-js): Deprecate metadata updates in user update methodschore(backend, clerk-js): Deprecate metadata updates in user update methodsJun 9, 2026
@wobsoriano
wobsoriano
enabled auto-merge (squash)
June 11, 2026 18:31
@wobsoriano
wobsoriano
merged commit b5fa9f6
into
mainJun 11, 2026

47 checks passed

@wobsoriano
wobsoriano
deleted the

bruno/user-5312-deprecate-update-user-metadata-fields

branch
June 11, 2026 18:31
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 11, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 1, 2026
 Merged


This was referenced Jul 11, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Aug 1, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

backendclerk-jsdo not mergeintegration

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brunol95@wobsoriano