Uh oh!
There was an error while loading. Please reload this page.
fix(expo): Fix expo-auth-session import leak and env var detection - #8607
Conversation
`ClerkProvider` previously called `require('expo-web-browser')` synchronously
inside an `isWeb()` runtime gate. Metro's static analyzer resolves literal-string
`require()` calls regardless of runtime gates or try/catch, so production
bundling failed for native consumers who don't install `expo-web-browser` (an
optional peer dependency).
Splits the web-only `maybeCompleteAuthSession()` call into a platform-specific
helper. Metro/Expo's platform resolver picks `maybeCompleteAuthSession.web.ts`
for web bundles and the no-op `maybeCompleteAuthSession.ts` for native — so
native dist no longer references `expo-web-browser`.
Behavior is unchanged at runtime on both platforms; the fix is purely at bundle
time.
The "env var detection" half of MOBILE-402 was already resolved in #7655
(publishableKey made a required prop, env-var fallback removed). No further
change needed there.
MOBILE-402🦋 Changeset detectedLatest commit: bbf9e1e The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…t-leak-and-env-var-detection
@clerk/astro@clerk/backend@clerk/chrome-extension@clerk/clerk-js@clerk/expo@clerk/expo-passkeys@clerk/express@clerk/fastify@clerk/hono@clerk/localizations@clerk/nextjs@clerk/nuxt@clerk/react@clerk/react-router@clerk/shared@clerk/tanstack-react-start@clerk/testing@clerk/ui@clerk/upgrade@clerk/vuecommit: |
Break Check: no API changes detected across the tracked packages. Last ran on |
📝 WalkthroughWalkthroughThis PR refactors the Expo package's OAuth/SSO completion logic to prevent Metro bundler from statically resolving the optional Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/expo/src/provider/ClerkProvider.tsx (1)
379-381: ⚡ Quick winAdd test coverage for the platform-split
maybeCompleteAuthSession.This PR introduces a new platform-resolved module (native no-op vs. web require of
expo-web-browser) but ships no tests. Given the bug being fixed (Metro statically resolving the optional peer on native), a regression here would be silent. Consider tests that assert: the web implementation invokesWebBrowser.maybeCompleteAuthSession()and swallows errors with a__DEV__warning when the peer is missing, and that the native variant is a no-op that never referencesexpo-web-browser.Want me to draft the Vitest cases for both
maybeCompleteAuthSession.tsandmaybeCompleteAuthSession.web.ts?As per coding guidelines: "If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/expo/src/provider/ClerkProvider.tsx` around lines 379 - 381, Add unit tests covering the platform-split maybeCompleteAuthSession behavior: create Vitest cases for maybeCompleteAuthSession.ts and maybeCompleteAuthSession.web.ts that (1) on web mock expo-web-browser and assert maybeCompleteAuthSession() calls WebBrowser.maybeCompleteAuthSession() and that when the peer is missing it swallows the error and emits a __DEV__ warning, and (2) on native assert the native maybeCompleteAuthSession implementation is a no-op and does not import or reference expo-web-browser (i.e., calling it does not attempt to require WebBrowser). Target the exported function maybeCompleteAuthSession to locate the implementations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/expo/src/provider/ClerkProvider.tsx`:
- Around line 379-381: Add unit tests covering the platform-split
maybeCompleteAuthSession behavior: create Vitest cases for
maybeCompleteAuthSession.ts and maybeCompleteAuthSession.web.ts that (1) on web
mock expo-web-browser and assert maybeCompleteAuthSession() calls
WebBrowser.maybeCompleteAuthSession() and that when the peer is missing it
swallows the error and emits a __DEV__ warning, and (2) on native assert the
native maybeCompleteAuthSession implementation is a no-op and does not import or
reference expo-web-browser (i.e., calling it does not attempt to require
WebBrowser). Target the exported function maybeCompleteAuthSession to locate the
implementations.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: a5705a5a-f1e8-4a53-bf20-3a1eb4b567dd
📒 Files selected for processing (4)
.changeset/expo_avoid_web_browser_static_require.mdpackages/expo/src/provider/ClerkProvider.tsxpackages/expo/src/provider/maybeCompleteAuthSession.tspackages/expo/src/provider/maybeCompleteAuthSession.web.ts
wobsoriano
commented
Jun 3, 2026
!snapshot |
Hey @wobsoriano - the snapshot version command generated the following package versions:
Tip: Use the snippet copy button below to quickly install the required packages. npm i @clerk/astro@3.3.4-snapshot.v20260603205452 --save-exact
npm i @clerk/backend@3.5.1-snapshot.v20260603205452 --save-exact
npm i @clerk/chrome-extension@3.1.33-snapshot.v20260603205452 --save-exact
npm i @clerk/clerk-js@6.14.1-snapshot.v20260603205452 --save-exact
npm i @clerk/expo@3.3.2-snapshot.v20260603205452 --save-exact
npm i @clerk/expo-passkeys@1.1.2-snapshot.v20260603205452 --save-exact
npm i @clerk/express@2.1.24-snapshot.v20260603205452 --save-exact
npm i @clerk/fastify@3.1.34-snapshot.v20260603205452 --save-exact
npm i @clerk/hono@0.1.34-snapshot.v20260603205452 --save-exact
npm i @clerk/localizations@4.7.2-snapshot.v20260603205452 --save-exact
npm i @clerk/msw@0.0.32-snapshot.v20260603205452 --save-exact
npm i @clerk/nextjs@7.4.4-snapshot.v20260603205452 --save-exact
npm i @clerk/nuxt@2.5.4-snapshot.v20260603205452 --save-exact
npm i @clerk/react@6.7.4-snapshot.v20260603205452 --save-exact
npm i @clerk/react-router@3.3.4-snapshot.v20260603205452 --save-exact
npm i @clerk/shared@4.15.1-snapshot.v20260603205452 --save-exact
npm i @clerk/tanstack-react-start@1.3.4-snapshot.v20260603205452 --save-exact
npm i @clerk/testing@2.0.36-snapshot.v20260603205452 --save-exact
npm i @clerk/ui@1.15.1-snapshot.v20260603205452 --save-exact
npm i @clerk/upgrade@2.0.4-snapshot.v20260603205452 --save-exact
npm i @clerk/vue@2.3.4-snapshot.v20260603205452 --save-exact |
Uh oh!
There was an error while loading. Please reload this page.
Summary
This PR fixes an optional-dependency leak in
@clerk/expo'sClerkProvider.Previously,
ClerkProvidersynchronously referencedexpo-web-browserbehind anisWeb()runtime check in order to callmaybeCompleteAuthSession()for OAuth/SSO flows on web. In Expo/Metro, that pattern can still causeexpo-web-browserto be picked up during native bundling even though it is only needed on web and is declared as an optional peer dependency.This change moves that logic into a platform-specific helper:
maybeCompleteAuthSession.web.tscontains the web implementationmaybeCompleteAuthSession.tsis a native no-opThat keeps web behavior unchanged while ensuring native bundles no longer reference
expo-web-browserthroughClerkProvider.Note: this is distinct from the
useSSO/expo-auth-sessionissue fixed separately #8720. This PR only addresses theClerkProviderexpo-web-browserleak.