You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@clerk/clerk-js@6.17.0
Minor Changes
Add internal OAuth transport support for native desktop SDK wrappers to run Clerk's prebuilt OAuth flows through a system browser. (#8831) by @wobsoriano
Patch Changes
Rename the <OrganizationProfile /> SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed from organization-self-serve-sso to organization-security, and a new organizationProfile.navbar.security localization key replaces organizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlem
Upgrade build tooling to Rspack 2 (No user-facing API changes). (#8382) by @jacekradko
Add internal OAuth transport support for native desktop SDK wrappers to run Clerk's prebuilt OAuth flows through a system browser. (#8831) by @wobsoriano
Add internal OAuth transport support for native desktop SDK wrappers to run Clerk's prebuilt OAuth flows through a system browser. (#8831) by @wobsoriano
Patch Changes
Align the HeadlessBrowserClerk.load() parameter type with the runtime behavior by accepting the full ClerkOptions, including isSatellite. The clerk-js implementation has always accepted and used isSatellite from load() options — it's the only way to configure a satellite app when using @clerk/clerk-js directly — but the type previously excluded it, producing a contradictory generated API reference and type errors for direct consumers. (#8846) by @manovotny
Add an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. (#8813) by @iagodahlem
Rename the <OrganizationProfile /> SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed from organization-self-serve-sso to organization-security, and a new organizationProfile.navbar.security localization key replaces organizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlem
Ship a self-contained CookieAttributes interface from @clerk/shared/cookie and use it in createCookieHandler's set/remove signatures. The published declarations previously referenced Cookies.CookieAttributes from js-cookie, which consumers could never resolve (the import was dropped from the declaration output and js-cookie ships no types), causing TS2503 errors under skipLibCheck: false and silently degrading the option types to any otherwise. (#8841) by @jacekradko
Resolve the browser connectivity heuristics (isValidBrowser, isBrowserOnline, and therefore isValidBrowserOnline) from the worker's navigator when window is unavailable but the code runs inside a WorkerGlobalScope. In a Web/Service Worker — most notably an MV3 extension background service worker (where @clerk/chrome-extension loads the background client) — there is no window, so these checks previously always reported "invalid/offline". That caused getToken() failures to be re-thrown as a misleading clerk_offline error and capped network retries lower than intended. The checks now read real connectivity from the worker's navigator. Server-side rendering continues to report false (the fallback requires a real worker scope, so a bare globalThis.navigator such as the one modern Node exposes is not treated as a browser), and behavior in standard browsers and React Native is unchanged. (#8827) by @royanger
Exclude self-identified server runtimes (Cloudflare-Workers, Node.js, Deno, Bun user agents) from the worker-scope navigator fallback used by isValidBrowser, isBrowserOnline, and isValidBrowserOnline. Today Cloudflare's workerd is excluded only because its self does not satisfy instanceof WorkerGlobalScope; this guard keeps the checks returning false on server-side worker runtimes even if that implementation detail changes, while real browser web/service workers (such as MV3 extension background workers) are unaffected. (#8840) by @jacekradko
Clarify the isSatellite JSDoc to note it must be set in load(), unlike domain, which is set in the Clerk constructor. This corrects the generated API reference for direct @clerk/clerk-js and <script> consumers, where load() is the only way to configure a satellite app. (#8845) by @SarahSoutoul
@clerk/ui@1.17.0
Minor Changes
Add internal OAuth transport support for native desktop SDK wrappers to run Clerk's prebuilt OAuth flows through a system browser. (#8831) by @wobsoriano
Patch Changes
Add an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. (#8813) by @iagodahlem
Rename the <OrganizationProfile /> SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed from organization-self-serve-sso to organization-security, and a new organizationProfile.navbar.security localization key replaces organizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlem
Upgrade build tooling to Rspack 2 (No user-facing API changes). (#8382) by @jacekradko
Align the HeadlessBrowserClerk.load() parameter type with the runtime behavior by accepting the full ClerkOptions, including isSatellite. The clerk-js implementation has always accepted and used isSatellite from load() options — it's the only way to configure a satellite app when using @clerk/clerk-js directly — but the type previously excluded it, producing a contradictory generated API reference and type errors for direct consumers. (#8846) by @manovotny
Add an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. (#8813) by @iagodahlem
Rename the <OrganizationProfile /> SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed from organization-self-serve-sso to organization-security, and a new organizationProfile.navbar.security localization key replaces organizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlem
When a Frontend API request exhausts its retries in the Playwright setupClerkTestingToken helper, the warning now includes response diagnostics (cf-ray, retry-after, content-type, and a truncated response body) so rate-limit responses can be attributed to their source. Network-error retry exhaustion now includes the error message in the warning as well. (#8848) by @jacekradko
Preserve the /// <reference types="cypress" /> directive in the published @clerk/testing/cypress type declarations. TypeScript's declaration emit previously dropped it, so the shipped types relied on the global Cypress namespace without declaring the dependency and failed to type-check under skipLibCheck: false. (#8841) by @jacekradko
Align the HeadlessBrowserClerk.load() parameter type with the runtime behavior by accepting the full ClerkOptions, including isSatellite. The clerk-js implementation has always accepted and used isSatellite from load() options — it's the only way to configure a satellite app when using @clerk/clerk-js directly — but the type previously excluded it, producing a contradictory generated API reference and type errors for direct consumers. (#8846) by @manovotny
Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@clerk/clerk-js@6.17.0
Minor Changes
Patch Changes
Rename the
<OrganizationProfile />SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed fromorganization-self-serve-ssotoorganization-security, and a neworganizationProfile.navbar.securitylocalization key replacesorganizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlemUpgrade build tooling to Rspack 2 (No user-facing API changes). (#8382) by @jacekradko
Updated dependencies [
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/react@6.10.0
Minor Changes
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/shared@4.18.0
Minor Changes
Patch Changes
Align the
HeadlessBrowserClerk.load()parameter type with the runtime behavior by accepting the fullClerkOptions, includingisSatellite. The clerk-js implementation has always accepted and usedisSatellitefromload()options — it's the only way to configure a satellite app when using@clerk/clerk-jsdirectly — but the type previously excluded it, producing a contradictory generated API reference and type errors for direct consumers. (#8846) by @manovotnyAdd an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. (#8813) by @iagodahlem
Rename the
<OrganizationProfile />SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed fromorganization-self-serve-ssotoorganization-security, and a neworganizationProfile.navbar.securitylocalization key replacesorganizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlemShip a self-contained
CookieAttributesinterface from@clerk/shared/cookieand use it increateCookieHandler'sset/removesignatures. The published declarations previously referencedCookies.CookieAttributesfrom js-cookie, which consumers could never resolve (the import was dropped from the declaration output and js-cookie ships no types), causing TS2503 errors underskipLibCheck: falseand silently degrading the option types toanyotherwise. (#8841) by @jacekradkoResolve the browser connectivity heuristics (
isValidBrowser,isBrowserOnline, and thereforeisValidBrowserOnline) from the worker'snavigatorwhenwindowis unavailable but the code runs inside aWorkerGlobalScope. In a Web/Service Worker — most notably an MV3 extension background service worker (where@clerk/chrome-extensionloads the background client) — there is nowindow, so these checks previously always reported "invalid/offline". That causedgetToken()failures to be re-thrown as a misleadingclerk_offlineerror and capped network retries lower than intended. The checks now read real connectivity from the worker'snavigator. Server-side rendering continues to reportfalse(the fallback requires a real worker scope, so a bareglobalThis.navigatorsuch as the one modern Node exposes is not treated as a browser), and behavior in standard browsers and React Native is unchanged. (#8827) by @royangerExclude self-identified server runtimes (
Cloudflare-Workers,Node.js,Deno,Bunuser agents) from the worker-scopenavigatorfallback used byisValidBrowser,isBrowserOnline, andisValidBrowserOnline. Today Cloudflare's workerd is excluded only because itsselfdoes not satisfyinstanceof WorkerGlobalScope; this guard keeps the checks returningfalseon server-side worker runtimes even if that implementation detail changes, while real browser web/service workers (such as MV3 extension background workers) are unaffected. (#8840) by @jacekradkoClarify the
isSatelliteJSDoc to note it must be set inload(), unlikedomain, which is set in theClerkconstructor. This corrects the generated API reference for direct@clerk/clerk-jsand<script>consumers, whereload()is the only way to configure a satellite app. (#8845) by @SarahSoutoul@clerk/ui@1.17.0
Minor Changes
Patch Changes
Add an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. (#8813) by @iagodahlem
Rename the
<OrganizationProfile />SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed fromorganization-self-serve-ssotoorganization-security, and a neworganizationProfile.navbar.securitylocalization key replacesorganizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlemUpgrade build tooling to Rspack 2 (No user-facing API changes). (#8382) by @jacekradko
Updated dependencies [
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/astro@3.4.3
Patch Changes
Align the
HeadlessBrowserClerk.load()parameter type with the runtime behavior by accepting the fullClerkOptions, includingisSatellite. The clerk-js implementation has always accepted and usedisSatellitefromload()options — it's the only way to configure a satellite app when using@clerk/clerk-jsdirectly — but the type previously excluded it, producing a contradictory generated API reference and type errors for direct consumers. (#8846) by @manovotnyUpdated dependencies [
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/backend@3.7.1
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/chrome-extension@3.1.36
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,fa23ad8,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/expo@3.4.3
Patch Changes
Bump the bundled
clerk-iosSDK from1.2.2to1.2.3. See the Clerk iOS release: https://github.com/clerk/clerk-ios/releases/tag/1.2.3. (#8854) by @clerk-cookieBump the bundled
clerk-iosSDK from1.2.3to1.2.4. See the Clerk iOS release: https://github.com/clerk/clerk-ios/releases/tag/1.2.4. (#8867) by @clerk-cookieFix platform-specific module resolution for Expo builds so native and web implementations are selected correctly. (#8865) by @wobsoriano
Updated dependencies [
f4167ec,17e4164,ed2cf75,67c04a4,fa23ad8,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/expo-passkeys@1.1.5
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/express@2.1.27
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/fastify@3.1.37
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/hono@0.1.37
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/localizations@4.8.2
Patch Changes
Add an overview to the organization profile Security page. The page now lands on a summary of the SSO connection — a status badge (Unconfigured, In Progress, Active, Inactive), the configuration details framed in a card (provider, domain, sign-on URL, issuer, certificate), and an actions menu with Edit, Activate / Deactivate, and Remove — and switches into the existing configuration flow on Start, Continue, or Edit. (#8813) by @iagodahlem
Rename the
<OrganizationProfile />SSO page to "Security". The navbar entry is now labeled "Security" with a shield icon, its route path changed fromorganization-self-serve-ssotoorganization-security, and a neworganizationProfile.navbar.securitylocalization key replacesorganizationProfile.navbar.selfServeSSO. (#8796) by @iagodahlemUpdated dependencies [
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/nextjs@7.5.3
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/nuxt@2.6.3
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/react-router@3.4.3
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/tanstack-react-start@1.4.3
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/testing@2.1.2
Patch Changes
When a Frontend API request exhausts its retries in the Playwright
setupClerkTestingTokenhelper, the warning now includes response diagnostics (cf-ray,retry-after,content-type, and a truncated response body) so rate-limit responses can be attributed to their source. Network-error retry exhaustion now includes the error message in the warning as well. (#8848) by @jacekradkoPreserve the
/// <reference types="cypress" />directive in the published@clerk/testing/cypresstype declarations. TypeScript's declaration emit previously dropped it, so the shipped types relied on the globalCypressnamespace without declaring the dependency and failed to type-check underskipLibCheck: false. (#8841) by @jacekradkoUpdated dependencies [
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/vue@2.4.3
Patch Changes
Align the
HeadlessBrowserClerk.load()parameter type with the runtime behavior by accepting the fullClerkOptions, includingisSatellite. The clerk-js implementation has always accepted and usedisSatellitefromload()options — it's the only way to configure a satellite app when using@clerk/clerk-jsdirectly — but the type previously excluded it, producing a contradictory generated API reference and type errors for direct consumers. (#8846) by @manovotnyUpdated dependencies [
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/msw@0.0.35
Patch Changes
f4167ec,17e4164,ed2cf75,67c04a4,51c8fdc,c2ba971,8744728,d9b5c7d]:@clerk/swingset@0.0.3
Patch Changes
17e4164,ed2cf75,67c04a4,fa23ad8]: