') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); ci(repo): Version packages by clerk-cookie · Pull Request #8679 · clerk/javascript · GitHub
Skip to content

ci(repo): Version packages - #8679

Merged
wobsoriano merged 1 commit into
mainfrom
changeset-release/main
Jun 3, 2026
Merged

ci(repo): Version packages#8679
wobsoriano merged 1 commit into
mainfrom
changeset-release/main

Conversation

@clerk-cookie

@clerk-cookieclerk-cookie commented May 27, 2026•
edited
Loading

Copy link
Copy Markdown
Collaborator

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@clerk/backend@3.5.0

Minor Changes

  • Add support for new Backend API user endpoints: (#8694) by @dmoerner
    • users.replaceUserEmailAddress(userId, { emailAddress }) replaces all of a user's email addresses with a single verified, primary email address (PUT /users/{user_id}/email_address).
    • users.replaceUserPhoneNumber(userId, { phoneNumber }) replaces all of a user's phone numbers with a single verified, primary phone number (PUT /users/{user_id}/phone_number).
    • users.createUser now accepts banned and locked parameters to create a user that is already banned or locked.

Patch Changes

  • Emit the "session token from cookie is missing the azp claim" warning once per process instead of on every authenticated request. An azp-less cookie token is reused across requests, so the previous unguarded console.warn could flood production logs. (#8698) by @jacekradko

  • Stop authenticateRequest from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling c.req.json()). (#8708) by @jacekradko

  • Prevent keyless mode from activating in CI and other automated environments in framework SDKs. (#8676) by @mwickett

  • Preserve custom claims when verifying JWT-format M2M tokens. M2MToken.fromJwtPayload previously hardcoded claims to null, so client.m2m.verify() (and request-level auth()) dropped any custom claims embedded in the token. Custom claims are now reconstructed from the verified payload by stripping only the structural claims the backend adds when minting the token (iss, sub, exp, nbf, iat, jti). User-supplied claims such as aud are preserved. Tokens without custom claims still return claims: null, consistent with the opaque-token path. (#8697) by @jacekradko

  • Strip private_metadata from the backend resource _raw payload in stripPrivateDataFromObject, preventing it from leaking into __clerk_ssr_state when a User/Organization resource is passed to buildClerkProps. (#8702) by @dominic-clerk

  • Updated dependencies [afb75e6, c3df67a, 86fd38f, 8d6bb56, 43dfefa, 5fc7b21, c2ba134]:

    • @clerk/shared@4.15.0

@clerk/clerk-js@6.14.0

Minor Changes

  • Internal <ConfigureSSO /> refactor to call new org-scoped enterprise connections FAPI endpoints, replacing the /me/ deprecated scope. (#8671) by @iagodahlem

Patch Changes

@clerk/shared@4.15.0

Minor Changes

  • Internal <ConfigureSSO /> refactor to call new org-scoped enterprise connections FAPI endpoints, replacing the /me/ deprecated scope. (#8671) by @iagodahlem

Patch Changes

  • Add support for Google Workspace SAML provider to self-serve SSO (#8690) by @LauraBeatris

  • Layer architecture for configure steps per IdP and protocol on <ConfigureSSO /> (#8651) by @LauraBeatris

  • Prevent keyless mode from activating in CI and other automated environments in framework SDKs. (#8676) by @mwickett

  • Add support for Microsoft Entra SAML provider to self-serve SSO (#8695) by @LauraBeatris

  • Replace the telemetry postinstall script with a one-time runtime notice, printed once per process on server runtimes (Node, excluding CI) when the telemetry collector boots against a development instance. Drops the std-env dependency. (#8549) by @jacekradko

    Removing postinstall improves the package's supply-chain posture: @clerk/shared no longer executes arbitrary code at install time, aligning with package-manager defaults that increasingly disable install scripts.

    Browser-only applications with no server-side Clerk runtime (e.g. a Vite SPA) will not surface an in-band notice. Telemetry behavior and opt-out (telemetry={false} or *_CLERK_TELEMETRY_DISABLED) are unchanged; disclosure for these setups is provided at https://clerk.com/docs/telemetry.

  • Nest rolldown's shared build chunks under dist/runtime/_chunks/ instead of emitting them flat next to the entry points. The package exposes "./*", which resolves to dist/runtime/*, so the content-hashed internal chunks were being picked up by API-diff tooling whenever a chunk hash shifted. Entry and type resolution are unchanged; the chunks are still referenced by relative path, and external ./_chunks/* package subpaths are blocked. (#8717) by @jacekradko

@clerk/ui@1.15.0

Minor Changes

  • Internal <ConfigureSSO /> refactor to call new org-scoped enterprise connections FAPI endpoints, replacing the /me/ deprecated scope. (#8671) by @iagodahlem

Patch Changes

  • Add support for Google Workspace SAML provider to self-serve SSO (#8690) by @LauraBeatris

  • Layer architecture for configure steps per IdP and protocol on <ConfigureSSO /> (#8651) by @LauraBeatris

  • Reworks the <ConfigureSSO /> confirmation step and adds a dedicated reset connection dialog: (#8706) by @iagodahlem

    • Introduces <ResetConnectionDialog /> — a modal-based, type-to-confirm dialog scoped to the wizard container that replaces the inline reset confirmation card. Wraps the destructive delete behind useReverification, clears the local provider selection, and rewinds the wizard to provider selection on success.
    • Restyles the confirmation step body: unified status header with an inline Active / Inactive badge, grouped Enable SSO and Domain rows, two-column configuration details rendered through ProfileSection.ItemList, outlined Configure again, destructive Reset connection, and an inactive-state banner inside the step footer.
    • Step.Header now accepts a badge prop so a step can render an inline status pill next to its title without crowding the right-aligned children slot.
    • OrganizationProfile forwards the shared content ref to <ConfigureSSO /> so the new dialog portals into the wizard chrome when the component is embedded inside the organization profile.

  • "Fix rendering issue for free trial badge." (#8712) by @l-armstrong

  • Fix the legal consent checkbox growing in size when its label wraps to a second line while using the simple theme. The checkbox is now aligned to the start of the row so it no longer stretches to match the label height. (#8705) by @dmoerner

  • Avoid sending duplicate verification codes when persisted email or phone code verifications are already pending. (#8548) by @jacekradko

  • Adds a wizard-wide reset connection entry on the <ConfigureSSO /> step footers: (#8711) by @iagodahlem

    • New Step.Footer.Reset compound part that renders a destructive ghost button on the leading edge of the footer and opens the existing ResetConnectionDialog. The slot owns its own open state and gates itself on the current enterprise connection, so it stays hidden on the provider selection step.
    • Wires the reset entry into the Verify Domain, Configure (Okta and Custom SAML), and Test steps so the reset action is reachable from anywhere in the wizard. The confirmation step keeps its in-body destructive button.
    • Exposes a configureSSOFooterResetButton element descriptor so the new button surface can be themed via appearance customizations.

  • Fix stepper chevron wrapping in <ConfigureSSO /> (#8693) by @alexcarpenter

  • Add support for Microsoft Entra SAML provider to self-serve SSO (#8695) by @LauraBeatris

  • Add mobile support for <ConfigureSSO /> navbar to display application name, logo and organization name (#8675) by @LauraBeatris

  • Scope the UserProfile active-devices fetch cache by user.id so a session switch or sign-out/sign-in on a shared device no longer renders the previous user's device activity (IP, location, browser/device) from the module-scoped cache. (#8703) by @dominic-clerk

  • Updated dependencies [afb75e6, c3df67a, 86fd38f, 8d6bb56, 43dfefa, 5fc7b21, c2ba134]:

    • @clerk/localizations@4.7.1
    • @clerk/shared@4.15.0

@clerk/astro@3.3.3

Patch Changes

@clerk/chrome-extension@3.1.32

Patch Changes

@clerk/expo@3.3.1

Patch Changes

@clerk/expo-passkeys@1.1.1

Patch Changes

@clerk/express@2.1.23

Patch Changes

@clerk/fastify@3.1.33

Patch Changes

@clerk/hono@0.1.33

Patch Changes

@clerk/localizations@4.7.1

Patch Changes

@clerk/nextjs@7.4.3

Patch Changes

@clerk/nuxt@2.5.3

Patch Changes

@clerk/react@6.7.3

Patch Changes

@clerk/react-router@3.3.3

Patch Changes

  • Prevent keyless mode from activating in CI and other automated environments in framework SDKs. (#8676) by @mwickett

  • Read VITE_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING on the client when React Router is used in SPA mode (or as a library). Previously the env-var shortcut only took effect through the SSR rootAuthLoader, so client-only setups had no way to suppress the development-keys warning without passing unsafe_disableDevelopmentModeConsoleWarning to <ClerkProvider> directly. (#8682) by @jacekradko

  • Updated dependencies [1c42351, 1701e0f, afb75e6, c3df67a, ff0cfef, 86fd38f, be55c4e, fb184de, 8d6bb56, 43dfefa, 5fc7b21, c2ba134]:

    • @clerk/backend@3.5.0
    • @clerk/shared@4.15.0
    • @clerk/react@6.7.3

@clerk/tanstack-react-start@1.3.3

Patch Changes

@clerk/testing@2.0.35

Patch Changes

@clerk/upgrade@2.0.3

Patch Changes

@clerk/vue@2.3.3

Patch Changes

@clerk/msw@0.0.31

Patch Changes

@vercel

vercelBot commented May 27, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 3, 2026 12:56pm

Request Review

@github-actions

github-actionsBot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Snapi: no API changes detected in @clerk/backend, @clerk/clerk-js, @clerk/nextjs, @clerk/react, @clerk/shared, @clerk/ui.

@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from ebe2cd5 to ec7617dCompareMay 28, 2026 14:07
@pkg-pr-new

pkg-pr-newBot commented May 28, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8679

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8679

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8679

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8679

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8679

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8679

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8679

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8679

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8679

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8679

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8679

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8679

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8679

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8679

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8679

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8679

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8679

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8679

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8679

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8679

commit: da29d79

@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from ec7617d to 68a0399CompareMay 28, 2026 14:23
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 68a0399 to 8d051f0CompareMay 28, 2026 15:00
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 8d051f0 to 119c6d0CompareMay 28, 2026 15:38
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 119c6d0 to d2b3854CompareMay 28, 2026 16:07
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from f975969 to 7e3c640CompareMay 29, 2026 20:48
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 7e3c640 to afe81cfCompareJune 1, 2026 16:30
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from afe81cf to 8aba014CompareJune 1, 2026 16:34
@github-actions

github-actionsBot commented Jun 1, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-03T12:59:15.295Z

Summary

MetricCount
Packages analyzed19
Packages with changes1
🔴 Breaking changes0
🟡 Non-breaking changes1
🟢 Additions0

🤖 This report was reviewed by claude-sonnet-4-6.

Note
Break Check could not snapshot 3 subpaths; the diff below excludes them.

  • @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
  • @clerk/testing ./cypress: Symbol not found for identifier: Cypress

@clerk/shared

Version: 4.14.0 → 4.15.0
Recommended bump: MINOR
Actual bump: MINOR ✅

Subpath ./apiUrlFromPublishableKey

🟡 Non-breaking Changes (1)

Modified: apiUrlFromPublishableKey
- apiUrlFromPublishableKey: (publishableKey: string) => "https://api.clerk.com" | "https://api.lclclerk.com" | "https://api.clerkstage.dev"+ apiUrlFromPublishableKey: (publishableKey: string) => "https://api.lclclerk.com" | "https://api.clerkstage.dev" | "https://api.clerk.com"

Static analyzer: Breaking change in function apiUrlFromPublishableKey: Return type changed: "https://api.clerk.com"|"https://api.lclclerk.com"|"https://api.clerkstage.dev" → "https://api.lclclerk.com"|"https://api.clerkstage.dev"|"https://api.clerk.com"

🤖 AI review (reclassified as non-breaking) (99%): The return type is a union of the same three identical string literal members — only their order changed, which is structurally equivalent in TypeScript; no consumer code that was well-typed before will fail to compile or behave differently.

Report generated by Break Check

Last ran on da29d79. Pushes that change no tracked declarations (no API surface change vs. base) are skipped and don't update this comment.

@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 8aba014 to 005d016CompareJune 1, 2026 17:57
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 005d016 to f38d6ffCompareJune 1, 2026 20:12
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from f38d6ff to 91c5d6bCompareJune 1, 2026 20:47
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 91c5d6b to 73d1feeCompareJune 1, 2026 21:46
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 73d1fee to 2a1c07eCompareJune 1, 2026 22:03
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 2a1c07e to 1afd9a1CompareJune 2, 2026 00:11
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 1afd9a1 to a39b71eCompareJune 2, 2026 02:31
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from a39b71e to b291ecfCompareJune 2, 2026 15:33
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from b291ecf to 602d004CompareJune 2, 2026 19:05
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 602d004 to 72f6211CompareJune 2, 2026 20:26
@clerk-cookie
clerk-cookieforce-pushed the changeset-release/main branch from 72f6211 to 696b870CompareJune 2, 2026 20:38
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees

No one assigned

Labels

astrobackendchrome-extensionclerk-jsexpoexpressfastifylocalizationsnextjsnuxtreactreact-routertanstacktestinguivue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@clerk-cookie@wobsoriano