Skip to content

fix(clerk-js): prevent broadcast failure from evicting a cached session token - #8969

Merged
jacekradko merged 2 commits into
mainfrom
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Jun 25, 2026
Merged

fix(clerk-js): prevent broadcast failure from evicting a cached session token#8969
jacekradko merged 2 commits into
mainfrom
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session

Conversation

@jacekradko

@jacekradkojacekradko commented Jun 23, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

SessionTokenCache.setInternal runs the cross-tab broadcast as the last step inside the token-resolution .then, and that whole chain ends in .catch(() => deleteKey()). So if postMessage (or getRawString) throws, the failure lands in that catch and evicts the token that was just cached and timer-scheduled, turning the next getToken() into an avoidable network fetch.

This isolates the broadcast side-effect in its own try/catch (logs a warning, keeps the cached token). The regression test reproduces the bug: with the guard removed, size() drops to 0 after a throwing postMessage; with the guard the token stays cached.

Fixes SDK-119. It is pre-existing in shipped clerk-js and a backport candidate, so it is scoped to just the broadcast guard, independent of the TokenCache decouple in #8860.

Summary by CodeRabbit

  • Bug Fixes

    • Fixed an issue where cross-tab token broadcasting failures would unnecessarily evict cached session tokens, preventing unexpected follow-up network requests on token retrieval.

  • Tests

    • Added test coverage for broadcast resilience to ensure cached tokens remain intact when cross-tab synchronization encounters message delivery failures.

@changeset-bot

changeset-botBot commented Jun 23, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 078a65b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
NameType
@clerk/clerk-jsPatch
@clerk/chrome-extensionPatch
@clerk/electronPatch
@clerk/expoPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 23, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 25, 2026 3:11am
swingsetReadyReadyPreview, CommentJun 25, 2026 3:11am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 23, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 1c26dfeb-ad96-48b1-b4f9-96eaa6b73852

📥 Commits

Reviewing files that changed from the base of the PR and between 52d310c and 96b8c0f.

📒 Files selected for processing (3)
  • .changeset/tokencache-broadcast-eviction.md
  • packages/clerk-js/src/core/__tests__/tokenCache.test.ts
  • packages/clerk-js/src/core/tokenCache.ts
📝 Walkthrough

Walkthrough

setInternal in tokenCache.ts now wraps the cross-tab BroadcastChannel.postMessage call in a try/catch. Broadcast failures log a warning instead of propagating to the outer .catch(() => deleteKey()), preserving the cached token. A new broadcast resilience test and changeset entry document the fix.

Changes

BroadcastChannel failure isolation in token cache

Layer / File(s)Summary
Broadcast try/catch fix, resilience test, and changeset
packages/clerk-js/src/core/tokenCache.ts, packages/clerk-js/src/core/__tests__/tokenCache.test.ts, .changeset/tokencache-broadcast-eviction.md		setInternal's resolved-token broadcast is wrapped in try/catch; errors log a warning and skip the outer .catch(() => deleteKey()) path. A new broadcast resilience test confirms the cache entry survives a postMessage throw. The changeset records the patch release.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 The broadcast may fail, the message may miss,
But the token stays safe — nothing's amiss!
A catch wraps the error, a warning gets logged,
No eviction occurs, no session is robbed.
Hop hop, little cache, you're resilient now! 🎉

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main fix: preventing broadcast failures from causing token cache eviction.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jun 23, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8969

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8969

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8969

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8969

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@8969

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@8969

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@8969

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8969

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8969

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8969

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8969

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8969

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8969

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8969

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8969

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8969

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8969

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8969

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8969

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8969

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8969

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8969

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8969

commit: 078a65b

@github-actions

github-actionsBot commented Jun 23, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-25T03:12:36.936Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.

Report generated by Break Check

Last ran on 078a65b.

wobsoriano
wobsoriano approved these changes Jun 25, 2026
View reviewed changes

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks straightforward

@jacekradko
jacekradko merged commit 2492043 into mainJun 25, 2026
48 checks passed
@jacekradko
jacekradko deleted the jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session branch June 25, 2026 11:36
@clerk-cookieclerk-cookie mentioned this pull request Jun 25, 2026
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request Jun 29, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees

No one assigned

Labels

clerk-js

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix(clerk-js): prevent broadcast failure from evicting a cached session token by jacekradko · Pull Request #8969 · clerk/javascript · GitHub
Skip to content
fix(clerk-js): prevent broadcast failure from evicting a cached session token - #8969
Merged
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Jun 25, 2026
Merged
fix(clerk-js): prevent broadcast failure from evicting a cached session token#8969
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 23, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
SessionTokenCache.setInternal runs the cross-tab broadcast as the last step inside the token-resolution .then, and that whole chain ends in .catch(() => deleteKey()). So if postMessage (or getRawString) throws, the failure lands in that catch and evicts the token that was just cached and timer-scheduled, turning the next getToken() into an avoidable network fetch.
This isolates the broadcast side-effect in its own try/catch (logs a warning, keeps the cached token). The regression test reproduces the bug: with the guard removed, size() drops to 0 after a throwing postMessage; with the guard the token stays cached.
Fixes SDK-119. It is pre-existing in shipped clerk-js and a backport candidate, so it is scoped to just the broadcast guard, independent of the TokenCache decouple in #8860.
Summary by CodeRabbit
  • Bug Fixes
    • Fixed an issue where cross-tab token broadcasting failures would unnecessarily evict cached session tokens, preventing unexpected follow-up network requests on token retrieval.
  • Tests
    • Added test coverage for broadcast resilience to ensure cached tokens remain intact when cross-tab synchronization encounters message delivery failures.
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 078a65b
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 4 packages
NameType
@clerk/clerk-jsPatch
@clerk/chrome-extensionPatch
@clerk/electronPatch
@clerk/expoPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 25, 2026 3:11am
swingsetReadyReadyPreview, CommentJun 25, 2026 3:11am
Request Review
@coderabbitai
coderabbitaiBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 1c26dfeb-ad96-48b1-b4f9-96eaa6b73852
📥 Commits
Reviewing files that changed from the base of the PR and between 52d310c and 96b8c0f.
📒 Files selected for processing (3)
  • .changeset/tokencache-broadcast-eviction.md
  • packages/clerk-js/src/core/__tests__/tokenCache.test.ts
  • packages/clerk-js/src/core/tokenCache.ts
📝 Walkthrough
Walkthrough
setInternal in tokenCache.ts now wraps the cross-tab BroadcastChannel.postMessage call in a try/catch. Broadcast failures log a warning instead of propagating to the outer .catch(() => deleteKey()), preserving the cached token. A new broadcast resilience test and changeset entry document the fix.
Changes
BroadcastChannel failure isolation in token cache
Layer / File(s)Summary
Broadcast try/catch fix, resilience test, and changeset
packages/clerk-js/src/core/tokenCache.ts, packages/clerk-js/src/core/__tests__/tokenCache.test.ts, .changeset/tokencache-broadcast-eviction.md		setInternal's resolved-token broadcast is wrapped in try/catch; errors log a warning and skip the outer .catch(() => deleteKey()) path. A new broadcast resilience test confirms the cache entry survives a postMessage throw. The changeset records the patch release.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
🐇 The broadcast may fail, the message may miss,

But the token stays safe — nothing's amiss!

A catch wraps the error, a warning gets logged,

No eviction occurs, no session is robbed.

Hop hop, little cache, you're resilient now! 🎉
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main fix: preventing broadcast failures from causing token cache eviction.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Warning
Tools execution failed with the following error:
Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)
Comment @coderabbitai help to get the list of available commands.
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8969

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8969

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8969

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8969

@clerk/electron
npm i https://pkg.pr.new/@clerk/electron@8969

@clerk/electron-passkeys
npm i https://pkg.pr.new/@clerk/electron-passkeys@8969

@clerk/eslint-plugin
npm i https://pkg.pr.new/@clerk/eslint-plugin@8969

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8969

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8969

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8969

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8969

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8969

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8969

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8969

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8969

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8969

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8969

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8969

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8969

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8969

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8969

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8969

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8969

commit: 078a65b
@github-actions
github-actionsBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-25T03:12:36.936Z
Summary
MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0
No API Changes Detected
All packages have stable APIs with no detected changes.
Report generated by Break Check
Last ran on 078a65b.
wobsoriano
wobsoriano
approved these changes
Jun 25, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks straightforward
@jacekradko
jacekradko
merged commit 2492043
into
mainJun 25, 2026

48 checks passed

@jacekradko
jacekradko
deleted the

jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session

branch
June 25, 2026 11:36
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 25, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

clerk-js

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(clerk-js): prevent broadcast failure from evicting a cached session token by jacekradko · Pull Request #8969 · clerk/javascript · GitHub
Skip to content
fix(clerk-js): prevent broadcast failure from evicting a cached session token - #8969
Merged
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Jun 25, 2026
Merged
fix(clerk-js): prevent broadcast failure from evicting a cached session token#8969
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 23, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
SessionTokenCache.setInternal runs the cross-tab broadcast as the last step inside the token-resolution .then, and that whole chain ends in .catch(() => deleteKey()). So if postMessage (or getRawString) throws, the failure lands in that catch and evicts the token that was just cached and timer-scheduled, turning the next getToken() into an avoidable network fetch.
This isolates the broadcast side-effect in its own try/catch (logs a warning, keeps the cached token). The regression test reproduces the bug: with the guard removed, size() drops to 0 after a throwing postMessage; with the guard the token stays cached.
Fixes SDK-119. It is pre-existing in shipped clerk-js and a backport candidate, so it is scoped to just the broadcast guard, independent of the TokenCache decouple in #8860.
Summary by CodeRabbit
  • Bug Fixes
    • Fixed an issue where cross-tab token broadcasting failures would unnecessarily evict cached session tokens, preventing unexpected follow-up network requests on token retrieval.
  • Tests
    • Added test coverage for broadcast resilience to ensure cached tokens remain intact when cross-tab synchronization encounters message delivery failures.
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 078a65b
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 4 packages
NameType
@clerk/clerk-jsPatch
@clerk/chrome-extensionPatch
@clerk/electronPatch
@clerk/expoPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 25, 2026 3:11am
swingsetReadyReadyPreview, CommentJun 25, 2026 3:11am
Request Review
@coderabbitai
coderabbitaiBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 1c26dfeb-ad96-48b1-b4f9-96eaa6b73852
📥 Commits
Reviewing files that changed from the base of the PR and between 52d310c and 96b8c0f.
📒 Files selected for processing (3)
  • .changeset/tokencache-broadcast-eviction.md
  • packages/clerk-js/src/core/__tests__/tokenCache.test.ts
  • packages/clerk-js/src/core/tokenCache.ts
📝 Walkthrough
Walkthrough
setInternal in tokenCache.ts now wraps the cross-tab BroadcastChannel.postMessage call in a try/catch. Broadcast failures log a warning instead of propagating to the outer .catch(() => deleteKey()), preserving the cached token. A new broadcast resilience test and changeset entry document the fix.
Changes
BroadcastChannel failure isolation in token cache
Layer / File(s)Summary
Broadcast try/catch fix, resilience test, and changeset
packages/clerk-js/src/core/tokenCache.ts, packages/clerk-js/src/core/__tests__/tokenCache.test.ts, .changeset/tokencache-broadcast-eviction.md		setInternal's resolved-token broadcast is wrapped in try/catch; errors log a warning and skip the outer .catch(() => deleteKey()) path. A new broadcast resilience test confirms the cache entry survives a postMessage throw. The changeset records the patch release.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
🐇 The broadcast may fail, the message may miss,

But the token stays safe — nothing's amiss!

A catch wraps the error, a warning gets logged,

No eviction occurs, no session is robbed.

Hop hop, little cache, you're resilient now! 🎉
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main fix: preventing broadcast failures from causing token cache eviction.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Warning
Tools execution failed with the following error:
Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)
Comment @coderabbitai help to get the list of available commands.
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8969

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8969

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8969

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8969

@clerk/electron
npm i https://pkg.pr.new/@clerk/electron@8969

@clerk/electron-passkeys
npm i https://pkg.pr.new/@clerk/electron-passkeys@8969

@clerk/eslint-plugin
npm i https://pkg.pr.new/@clerk/eslint-plugin@8969

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8969

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8969

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8969

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8969

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8969

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8969

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8969

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8969

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8969

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8969

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8969

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8969

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8969

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8969

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8969

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8969

commit: 078a65b
@github-actions
github-actionsBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-25T03:12:36.936Z
Summary
MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0
No API Changes Detected
All packages have stable APIs with no detected changes.
Report generated by Break Check
Last ran on 078a65b.
wobsoriano
wobsoriano
approved these changes
Jun 25, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks straightforward
@jacekradko
jacekradko
merged commit 2492043
into
mainJun 25, 2026

48 checks passed

@jacekradko
jacekradko
deleted the

jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session

branch
June 25, 2026 11:36
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 25, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

clerk-js

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(clerk-js): prevent broadcast failure from evicting a cached session token by jacekradko · Pull Request #8969 · clerk/javascript · GitHub
Skip to content
fix(clerk-js): prevent broadcast failure from evicting a cached session token - #8969
Merged
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Jun 25, 2026
Merged
fix(clerk-js): prevent broadcast failure from evicting a cached session token#8969
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 23, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
SessionTokenCache.setInternal runs the cross-tab broadcast as the last step inside the token-resolution .then, and that whole chain ends in .catch(() => deleteKey()). So if postMessage (or getRawString) throws, the failure lands in that catch and evicts the token that was just cached and timer-scheduled, turning the next getToken() into an avoidable network fetch.
This isolates the broadcast side-effect in its own try/catch (logs a warning, keeps the cached token). The regression test reproduces the bug: with the guard removed, size() drops to 0 after a throwing postMessage; with the guard the token stays cached.
Fixes SDK-119. It is pre-existing in shipped clerk-js and a backport candidate, so it is scoped to just the broadcast guard, independent of the TokenCache decouple in #8860.
Summary by CodeRabbit
  • Bug Fixes
    • Fixed an issue where cross-tab token broadcasting failures would unnecessarily evict cached session tokens, preventing unexpected follow-up network requests on token retrieval.
  • Tests
    • Added test coverage for broadcast resilience to ensure cached tokens remain intact when cross-tab synchronization encounters message delivery failures.
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 078a65b
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 4 packages
NameType
@clerk/clerk-jsPatch
@clerk/chrome-extensionPatch
@clerk/electronPatch
@clerk/expoPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 25, 2026 3:11am
swingsetReadyReadyPreview, CommentJun 25, 2026 3:11am
Request Review
@coderabbitai
coderabbitaiBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 1c26dfeb-ad96-48b1-b4f9-96eaa6b73852
📥 Commits
Reviewing files that changed from the base of the PR and between 52d310c and 96b8c0f.
📒 Files selected for processing (3)
  • .changeset/tokencache-broadcast-eviction.md
  • packages/clerk-js/src/core/__tests__/tokenCache.test.ts
  • packages/clerk-js/src/core/tokenCache.ts
📝 Walkthrough
Walkthrough
setInternal in tokenCache.ts now wraps the cross-tab BroadcastChannel.postMessage call in a try/catch. Broadcast failures log a warning instead of propagating to the outer .catch(() => deleteKey()), preserving the cached token. A new broadcast resilience test and changeset entry document the fix.
Changes
BroadcastChannel failure isolation in token cache
Layer / File(s)Summary
Broadcast try/catch fix, resilience test, and changeset
packages/clerk-js/src/core/tokenCache.ts, packages/clerk-js/src/core/__tests__/tokenCache.test.ts, .changeset/tokencache-broadcast-eviction.md		setInternal's resolved-token broadcast is wrapped in try/catch; errors log a warning and skip the outer .catch(() => deleteKey()) path. A new broadcast resilience test confirms the cache entry survives a postMessage throw. The changeset records the patch release.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
🐇 The broadcast may fail, the message may miss,

But the token stays safe — nothing's amiss!

A catch wraps the error, a warning gets logged,

No eviction occurs, no session is robbed.

Hop hop, little cache, you're resilient now! 🎉
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main fix: preventing broadcast failures from causing token cache eviction.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Warning
Tools execution failed with the following error:
Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)
Comment @coderabbitai help to get the list of available commands.
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8969

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8969

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8969

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8969

@clerk/electron
npm i https://pkg.pr.new/@clerk/electron@8969

@clerk/electron-passkeys
npm i https://pkg.pr.new/@clerk/electron-passkeys@8969

@clerk/eslint-plugin
npm i https://pkg.pr.new/@clerk/eslint-plugin@8969

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8969

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8969

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8969

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8969

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8969

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8969

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8969

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8969

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8969

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8969

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8969

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8969

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8969

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8969

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8969

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8969

commit: 078a65b
@github-actions
github-actionsBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-25T03:12:36.936Z
Summary
MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0
No API Changes Detected
All packages have stable APIs with no detected changes.
Report generated by Break Check
Last ran on 078a65b.
wobsoriano
wobsoriano
approved these changes
Jun 25, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks straightforward
@jacekradko
jacekradko
merged commit 2492043
into
mainJun 25, 2026

48 checks passed

@jacekradko
jacekradko
deleted the

jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session

branch
June 25, 2026 11:36
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 25, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

clerk-js

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix(clerk-js): prevent broadcast failure from evicting a cached session token by jacekradko · Pull Request #8969 · clerk/javascript · GitHub
Skip to content
fix(clerk-js): prevent broadcast failure from evicting a cached session token - #8969
Merged
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Jun 25, 2026
Merged
fix(clerk-js): prevent broadcast failure from evicting a cached session token#8969
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 23, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
SessionTokenCache.setInternal runs the cross-tab broadcast as the last step inside the token-resolution .then, and that whole chain ends in .catch(() => deleteKey()). So if postMessage (or getRawString) throws, the failure lands in that catch and evicts the token that was just cached and timer-scheduled, turning the next getToken() into an avoidable network fetch.
This isolates the broadcast side-effect in its own try/catch (logs a warning, keeps the cached token). The regression test reproduces the bug: with the guard removed, size() drops to 0 after a throwing postMessage; with the guard the token stays cached.
Fixes SDK-119. It is pre-existing in shipped clerk-js and a backport candidate, so it is scoped to just the broadcast guard, independent of the TokenCache decouple in #8860.
Summary by CodeRabbit
  • Bug Fixes
    • Fixed an issue where cross-tab token broadcasting failures would unnecessarily evict cached session tokens, preventing unexpected follow-up network requests on token retrieval.
  • Tests
    • Added test coverage for broadcast resilience to ensure cached tokens remain intact when cross-tab synchronization encounters message delivery failures.
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 078a65b
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 4 packages
NameType
@clerk/clerk-jsPatch
@clerk/chrome-extensionPatch
@clerk/electronPatch
@clerk/expoPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 25, 2026 3:11am
swingsetReadyReadyPreview, CommentJun 25, 2026 3:11am
Request Review
@coderabbitai
coderabbitaiBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 1c26dfeb-ad96-48b1-b4f9-96eaa6b73852
📥 Commits
Reviewing files that changed from the base of the PR and between 52d310c and 96b8c0f.
📒 Files selected for processing (3)
  • .changeset/tokencache-broadcast-eviction.md
  • packages/clerk-js/src/core/__tests__/tokenCache.test.ts
  • packages/clerk-js/src/core/tokenCache.ts
📝 Walkthrough
Walkthrough
setInternal in tokenCache.ts now wraps the cross-tab BroadcastChannel.postMessage call in a try/catch. Broadcast failures log a warning instead of propagating to the outer .catch(() => deleteKey()), preserving the cached token. A new broadcast resilience test and changeset entry document the fix.
Changes
BroadcastChannel failure isolation in token cache
Layer / File(s)Summary
Broadcast try/catch fix, resilience test, and changeset
packages/clerk-js/src/core/tokenCache.ts, packages/clerk-js/src/core/__tests__/tokenCache.test.ts, .changeset/tokencache-broadcast-eviction.md		setInternal's resolved-token broadcast is wrapped in try/catch; errors log a warning and skip the outer .catch(() => deleteKey()) path. A new broadcast resilience test confirms the cache entry survives a postMessage throw. The changeset records the patch release.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
🐇 The broadcast may fail, the message may miss,

But the token stays safe — nothing's amiss!

A catch wraps the error, a warning gets logged,

No eviction occurs, no session is robbed.

Hop hop, little cache, you're resilient now! 🎉
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main fix: preventing broadcast failures from causing token cache eviction.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Warning
Tools execution failed with the following error:
Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)
Comment @coderabbitai help to get the list of available commands.
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8969

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8969

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8969

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8969

@clerk/electron
npm i https://pkg.pr.new/@clerk/electron@8969

@clerk/electron-passkeys
npm i https://pkg.pr.new/@clerk/electron-passkeys@8969

@clerk/eslint-plugin
npm i https://pkg.pr.new/@clerk/eslint-plugin@8969

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8969

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8969

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8969

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8969

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8969

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8969

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8969

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8969

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8969

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8969

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8969

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8969

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8969

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8969

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8969

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8969

commit: 078a65b
@github-actions
github-actionsBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-25T03:12:36.936Z
Summary
MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0
No API Changes Detected
All packages have stable APIs with no detected changes.
Report generated by Break Check
Last ran on 078a65b.
wobsoriano
wobsoriano
approved these changes
Jun 25, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks straightforward
@jacekradko
jacekradko
merged commit 2492043
into
mainJun 25, 2026

48 checks passed

@jacekradko
jacekradko
deleted the

jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session

branch
June 25, 2026 11:36
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 25, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

clerk-js

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(clerk-js): prevent broadcast failure from evicting a cached session token by jacekradko · Pull Request #8969 · clerk/javascript · GitHub
Skip to content
fix(clerk-js): prevent broadcast failure from evicting a cached session token - #8969
Merged
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Jun 25, 2026
Merged
fix(clerk-js): prevent broadcast failure from evicting a cached session token#8969
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 23, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
SessionTokenCache.setInternal runs the cross-tab broadcast as the last step inside the token-resolution .then, and that whole chain ends in .catch(() => deleteKey()). So if postMessage (or getRawString) throws, the failure lands in that catch and evicts the token that was just cached and timer-scheduled, turning the next getToken() into an avoidable network fetch.
This isolates the broadcast side-effect in its own try/catch (logs a warning, keeps the cached token). The regression test reproduces the bug: with the guard removed, size() drops to 0 after a throwing postMessage; with the guard the token stays cached.
Fixes SDK-119. It is pre-existing in shipped clerk-js and a backport candidate, so it is scoped to just the broadcast guard, independent of the TokenCache decouple in #8860.
Summary by CodeRabbit
  • Bug Fixes
    • Fixed an issue where cross-tab token broadcasting failures would unnecessarily evict cached session tokens, preventing unexpected follow-up network requests on token retrieval.
  • Tests
    • Added test coverage for broadcast resilience to ensure cached tokens remain intact when cross-tab synchronization encounters message delivery failures.
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 078a65b
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 4 packages
NameType
@clerk/clerk-jsPatch
@clerk/chrome-extensionPatch
@clerk/electronPatch
@clerk/expoPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 25, 2026 3:11am
swingsetReadyReadyPreview, CommentJun 25, 2026 3:11am
Request Review
@coderabbitai
coderabbitaiBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 1c26dfeb-ad96-48b1-b4f9-96eaa6b73852
📥 Commits
Reviewing files that changed from the base of the PR and between 52d310c and 96b8c0f.
📒 Files selected for processing (3)
  • .changeset/tokencache-broadcast-eviction.md
  • packages/clerk-js/src/core/__tests__/tokenCache.test.ts
  • packages/clerk-js/src/core/tokenCache.ts
📝 Walkthrough
Walkthrough
setInternal in tokenCache.ts now wraps the cross-tab BroadcastChannel.postMessage call in a try/catch. Broadcast failures log a warning instead of propagating to the outer .catch(() => deleteKey()), preserving the cached token. A new broadcast resilience test and changeset entry document the fix.
Changes
BroadcastChannel failure isolation in token cache
Layer / File(s)Summary
Broadcast try/catch fix, resilience test, and changeset
packages/clerk-js/src/core/tokenCache.ts, packages/clerk-js/src/core/__tests__/tokenCache.test.ts, .changeset/tokencache-broadcast-eviction.md		setInternal's resolved-token broadcast is wrapped in try/catch; errors log a warning and skip the outer .catch(() => deleteKey()) path. A new broadcast resilience test confirms the cache entry survives a postMessage throw. The changeset records the patch release.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
🐇 The broadcast may fail, the message may miss,

But the token stays safe — nothing's amiss!

A catch wraps the error, a warning gets logged,

No eviction occurs, no session is robbed.

Hop hop, little cache, you're resilient now! 🎉
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main fix: preventing broadcast failures from causing token cache eviction.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Warning
Tools execution failed with the following error:
Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)
Comment @coderabbitai help to get the list of available commands.
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8969

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8969

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8969

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8969

@clerk/electron
npm i https://pkg.pr.new/@clerk/electron@8969

@clerk/electron-passkeys
npm i https://pkg.pr.new/@clerk/electron-passkeys@8969

@clerk/eslint-plugin
npm i https://pkg.pr.new/@clerk/eslint-plugin@8969

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8969

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8969

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8969

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8969

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8969

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8969

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8969

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8969

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8969

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8969

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8969

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8969

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8969

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8969

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8969

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8969

commit: 078a65b
@github-actions
github-actionsBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-25T03:12:36.936Z
Summary
MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0
No API Changes Detected
All packages have stable APIs with no detected changes.
Report generated by Break Check
Last ran on 078a65b.
wobsoriano
wobsoriano
approved these changes
Jun 25, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks straightforward
@jacekradko
jacekradko
merged commit 2492043
into
mainJun 25, 2026

48 checks passed

@jacekradko
jacekradko
deleted the

jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session

branch
June 25, 2026 11:36
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 25, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

clerk-js

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
fix(clerk-js): prevent broadcast failure from evicting a cached session token by jacekradko · Pull Request #8969 · clerk/javascript · GitHub
Skip to content
fix(clerk-js): prevent broadcast failure from evicting a cached session token - #8969
Merged
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Jun 25, 2026
Merged
fix(clerk-js): prevent broadcast failure from evicting a cached session token#8969
jacekradko merged 2 commits into
mainfrom 
jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session
Conversation
@jacekradko
@jacekradkojacekradko
commented
Jun 23, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Contributor
SessionTokenCache.setInternal runs the cross-tab broadcast as the last step inside the token-resolution .then, and that whole chain ends in .catch(() => deleteKey()). So if postMessage (or getRawString) throws, the failure lands in that catch and evicts the token that was just cached and timer-scheduled, turning the next getToken() into an avoidable network fetch.
This isolates the broadcast side-effect in its own try/catch (logs a warning, keeps the cached token). The regression test reproduces the bug: with the guard removed, size() drops to 0 after a throwing postMessage; with the guard the token stays cached.
Fixes SDK-119. It is pre-existing in shipped clerk-js and a backport candidate, so it is scoped to just the broadcast guard, independent of the TokenCache decouple in #8860.
Summary by CodeRabbit
  • Bug Fixes
    • Fixed an issue where cross-tab token broadcasting failures would unnecessarily evict cached session tokens, preventing unexpected follow-up network requests on token retrieval.
  • Tests
    • Added test coverage for broadcast resilience to ensure cached tokens remain intact when cross-tab synchronization encounters message delivery failures.
@changeset-bot
changeset-botBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 078a65b
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 4 packages
NameType
@clerk/clerk-jsPatch
@clerk/chrome-extensionPatch
@clerk/electronPatch
@clerk/expoPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 25, 2026 3:11am
swingsetReadyReadyPreview, CommentJun 25, 2026 3:11am
Request Review
@coderabbitai
coderabbitaiBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Review Change Stack
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 1c26dfeb-ad96-48b1-b4f9-96eaa6b73852
📥 Commits
Reviewing files that changed from the base of the PR and between 52d310c and 96b8c0f.
📒 Files selected for processing (3)
  • .changeset/tokencache-broadcast-eviction.md
  • packages/clerk-js/src/core/__tests__/tokenCache.test.ts
  • packages/clerk-js/src/core/tokenCache.ts
📝 Walkthrough
Walkthrough
setInternal in tokenCache.ts now wraps the cross-tab BroadcastChannel.postMessage call in a try/catch. Broadcast failures log a warning instead of propagating to the outer .catch(() => deleteKey()), preserving the cached token. A new broadcast resilience test and changeset entry document the fix.
Changes
BroadcastChannel failure isolation in token cache
Layer / File(s)Summary
Broadcast try/catch fix, resilience test, and changeset
packages/clerk-js/src/core/tokenCache.ts, packages/clerk-js/src/core/__tests__/tokenCache.test.ts, .changeset/tokencache-broadcast-eviction.md		setInternal's resolved-token broadcast is wrapped in try/catch; errors log a warning and skip the outer .catch(() => deleteKey()) path. A new broadcast resilience test confirms the cache entry survives a postMessage throw. The changeset records the patch release.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
🐇 The broadcast may fail, the message may miss,

But the token stays safe — nothing's amiss!

A catch wraps the error, a warning gets logged,

No eviction occurs, no session is robbed.

Hop hop, little cache, you're resilient now! 🎉
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely summarizes the main fix: preventing broadcast failures from causing token cache eviction.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
📝 Generate docstrings
  •  Create stacked PR
  •  Commit on current branch
Warning
Tools execution failed with the following error:
Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)
Comment @coderabbitai help to get the list of available commands.
@pkg-pr-new
pkg-pr-newBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8969

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8969

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8969

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8969

@clerk/electron
npm i https://pkg.pr.new/@clerk/electron@8969

@clerk/electron-passkeys
npm i https://pkg.pr.new/@clerk/electron-passkeys@8969

@clerk/eslint-plugin
npm i https://pkg.pr.new/@clerk/eslint-plugin@8969

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8969

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8969

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8969

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8969

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8969

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8969

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8969

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8969

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8969

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8969

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8969

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8969

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8969

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8969

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8969

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8969

commit: 078a65b
@github-actions
github-actionsBot
commented
Jun 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
API Changes Report
Generated by Break Check on 2026-06-25T03:12:36.936Z
Summary
MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0
No API Changes Detected
All packages have stable APIs with no detected changes.
Report generated by Break Check
Last ran on 078a65b.
wobsoriano
wobsoriano
approved these changes
Jun 25, 2026
View reviewed changes
@wobsorianowobsoriano
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks straightforward
@jacekradko
jacekradko
merged commit 2492043
into
mainJun 25, 2026

48 checks passed

@jacekradko
jacekradko
deleted the

jacek/sdk-119-broadcast-postmessage-failure-evicts-a-valid-cached-session

branch
June 25, 2026 11:36
@clerk-cookieclerk-cookie
mentioned this pull request
Jun 25, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@wobsorianowobsorianowobsoriano approved these changes

Assignees


No one assigned


Labels

clerk-js

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@wobsoriano