Skip to content

ci(repo): Version packages - #9893

Merged
wobsoriano merged 1 commit into
mainfrom
changeset-release/main
Sep 24, 2026
Merged

wobsoriano merged 1 commit into
mainfrom
changeset-release/main

Conversation

@clerk-cookie

@clerk-cookie clerk-cookie commented Sep 23, 2026 •

Copy link
Copy Markdown
Collaborator

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@clerk/backend@3.20.0

Minor Changes

  • Add an optional nameQuery filter to oauthApplications.list() to search OAuth applications by name or exact client ID. (#9904) by @austincalvelage

Patch Changes

@clerk/clerk-js@6.34.0

Minor Changes

  • The "Add members" card on the SSO allow list page of <OrganizationProfile /> now offers two ways to add people: by email address, or every member with a given role at once. Members whose email address is not served by one of the organization's enterprise connections are skipped. When nothing could be added the card stays open and says why, and when some were added it moves to a success step that reports how many were skipped. (#9826) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist gains addUsers({ userIds }), which calls the new bulk endpoint in batches of 100 and returns the added entries together with the users that could not be added and why.

    Inputs marked to be ignored by password managers now also carry the Bitwarden, LastPass and Dashlane opt-out attributes, so those extensions stop offering to fill fields such as the allow list email address.

    The member picker that the "Add member" card shipped with in 4.18.0 is gone, and so are its localization keys under organizationProfile.securityPage.ssoBypassPage.addForm: memberLabel, memberPlaceholder, changeButton and noResults. The feature was never enabled on any instance, so no application depends on them.

    New customization handles: the organizationProfileSecuritySsoBypassEmailInput, organizationProfileSecuritySsoBypassRoleWarning, organizationProfileSecuritySsoBypassFailure and organizationProfileSecuritySsoBypassBulkResult appearance elements.

Patch Changes

  • Show the provider logo next to each connection name on the enterprise account chooser. (#9895) by @NicolasLopes7

  • Fix <OAuthConsent /> rendering a blank page when reached through the redirect after completing <SignIn /> or <SignUp />. (#9896) by @wobsoriano

  • Updated dependencies [b3af79e, cc6f11a, d46b544, f50f48c]:

    • @clerk/shared@4.35.0

@clerk/expo@4.7.0

Minor Changes

  • Add useBiometricCredentials().reverify() for first-, second-, and multi-factor verification of the active session on iOS and Android. If the first factor still requires a second factor, reverification continues the same attempt automatically. Successful verification refreshes the JavaScript session token without creating a new session. (#9829) by @seanperez29

    New biometric enrollments default to biometry_current_set, requiring biometrics without device-passcode fallback. Existing credentials keep their original policy; reverification on iOS and Android requires the stronger policy and returns biometric_credential_policy_incompatible for older, weaker credentials. Apps should offer another verification method in that case. Reverification requires an updated native development build.

Patch Changes

@clerk/localizations@4.19.0

Minor Changes

  • The "Add members" card on the SSO allow list page of <OrganizationProfile /> now offers two ways to add people: by email address, or every member with a given role at once. Members whose email address is not served by one of the organization's enterprise connections are skipped. When nothing could be added the card stays open and says why, and when some were added it moves to a success step that reports how many were skipped. (#9826) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist gains addUsers({ userIds }), which calls the new bulk endpoint in batches of 100 and returns the added entries together with the users that could not be added and why.

    Inputs marked to be ignored by password managers now also carry the Bitwarden, LastPass and Dashlane opt-out attributes, so those extensions stop offering to fill fields such as the allow list email address.

    The member picker that the "Add member" card shipped with in 4.18.0 is gone, and so are its localization keys under organizationProfile.securityPage.ssoBypassPage.addForm: memberLabel, memberPlaceholder, changeButton and noResults. The feature was never enabled on any instance, so no application depends on them.

    New customization handles: the organizationProfileSecuritySsoBypassEmailInput, organizationProfileSecuritySsoBypassRoleWarning, organizationProfileSecuritySsoBypassFailure and organizationProfileSecuritySsoBypassBulkResult appearance elements.

  • Localize icon-only social sign-in button names using socialButtonsBlockButton and exclude decorative provider icons from the accessibility tree. Add formFieldAction__showPassword and formFieldAction__hidePassword localization keys for password visibility controls, with translations for every supported locale and English fallback for older localization resources. (#9897) by @jigar-clerk

Patch Changes

@clerk/shared@4.35.0

Minor Changes

  • The "Add members" card on the SSO allow list page of <OrganizationProfile /> now offers two ways to add people: by email address, or every member with a given role at once. Members whose email address is not served by one of the organization's enterprise connections are skipped. When nothing could be added the card stays open and says why, and when some were added it moves to a success step that reports how many were skipped. (#9826) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist gains addUsers({ userIds }), which calls the new bulk endpoint in batches of 100 and returns the added entries together with the users that could not be added and why.

    Inputs marked to be ignored by password managers now also carry the Bitwarden, LastPass and Dashlane opt-out attributes, so those extensions stop offering to fill fields such as the allow list email address.

    The member picker that the "Add member" card shipped with in 4.18.0 is gone, and so are its localization keys under organizationProfile.securityPage.ssoBypassPage.addForm: memberLabel, memberPlaceholder, changeButton and noResults. The feature was never enabled on any instance, so no application depends on them.

    New customization handles: the organizationProfileSecuritySsoBypassEmailInput, organizationProfileSecuritySsoBypassRoleWarning, organizationProfileSecuritySsoBypassFailure and organizationProfileSecuritySsoBypassBulkResult appearance elements.

  • Localize icon-only social sign-in button names using socialButtonsBlockButton and exclude decorative provider icons from the accessibility tree. Add formFieldAction__showPassword and formFieldAction__hidePassword localization keys for password visibility controls, with translations for every supported locale and English fallback for older localization resources. (#9897) by @jigar-clerk

Patch Changes

  • Show the provider logo next to each connection name on the enterprise account chooser. (#9895) by @NicolasLopes7

  • Missing and invalid key errors now list the Clerk CLI commands that fix them: npx clerk@latest init for a new app, npx clerk@latest link and npx clerk@latest env pull for an existing one, and npx clerk@latest env pull --instance prod for production keys. The missing secret key error skips init, since the publishable key already points to an existing app. (#9848) by @eatmorespinach

@clerk/tanstack-react-start@1.6.0

Minor Changes

  • In development, missing Clerk keys no longer activate keyless mode. When VITE_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY are not set, the SDK now fails with an error directing you to run npx clerk@latest init, which provisions a Clerk application and writes the keys to .env.local. Keys that keyless mode stored in the .clerk/ directory are no longer read, and VITE_CLERK_KEYLESS_DISABLED and CLERK_KEYLESS_DISABLED no longer have any effect. Existing apps with configured keys are unaffected. (#9578) by @djgould

Patch Changes

@clerk/ui@1.35.0

Minor Changes

  • The "Add members" card on the SSO allow list page of <OrganizationProfile /> now offers two ways to add people: by email address, or every member with a given role at once. Members whose email address is not served by one of the organization's enterprise connections are skipped. When nothing could be added the card stays open and says why, and when some were added it moves to a success step that reports how many were skipped. (#9826) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist gains addUsers({ userIds }), which calls the new bulk endpoint in batches of 100 and returns the added entries together with the users that could not be added and why.

    Inputs marked to be ignored by password managers now also carry the Bitwarden, LastPass and Dashlane opt-out attributes, so those extensions stop offering to fill fields such as the allow list email address.

    The member picker that the "Add member" card shipped with in 4.18.0 is gone, and so are its localization keys under organizationProfile.securityPage.ssoBypassPage.addForm: memberLabel, memberPlaceholder, changeButton and noResults. The feature was never enabled on any instance, so no application depends on them.

    New customization handles: the organizationProfileSecuritySsoBypassEmailInput, organizationProfileSecuritySsoBypassRoleWarning, organizationProfileSecuritySsoBypassFailure and organizationProfileSecuritySsoBypassBulkResult appearance elements.

Patch Changes

  • Show the provider logo next to each connection name on the enterprise account chooser. (#9895) by @NicolasLopes7

  • Localize icon-only social sign-in button names using socialButtonsBlockButton and exclude decorative provider icons from the accessibility tree. Add formFieldAction__showPassword and formFieldAction__hidePassword localization keys for password visibility controls, with translations for every supported locale and English fallback for older localization resources. (#9897) by @jigar-clerk

  • Fix <UserProfile /> crashing with "Rendered fewer hooks than expected" after connecting the last available Web3 wallet. (#9900) by @dmoerner

  • Updated dependencies [b3af79e, cc6f11a, d46b544, f50f48c]:

    • @clerk/shared@4.35.0
    • @clerk/localizations@4.19.0

@clerk/astro@4.1.5

Patch Changes

@clerk/chrome-extension@3.1.86

Patch Changes

@clerk/electron@0.0.46

Patch Changes

@clerk/expo-passkeys@2.0.22

Patch Changes

  • Fix passkey registration on iOS ignoring the credentials Clerk asks it to exclude, which allowed a second passkey to be created for an account that already had one on the device. Registering a duplicate now fails with passkey_already_exists, matching Android and web. (#9920) by @wobsoriano

  • Updated dependencies [b3af79e, cc6f11a, d46b544, f50f48c]:

    • @clerk/shared@4.35.0

@clerk/express@2.1.71

Patch Changes

@clerk/fastify@3.1.81

Patch Changes

@clerk/hono@0.1.81

Patch Changes

@clerk/mosaic@0.1.1

Patch Changes

@clerk/nextjs@7.9.6

Patch Changes

@clerk/nuxt@3.1.5

Patch Changes

  • Fix clerkMiddleware() dropping all but the last Set-Cookie header when Clerk sets multiple cookies in one response, such as after a handshake or a session refresh. (#9894) by @wobsoriano

  • Updated dependencies [b3af79e, cc6f11a, 9d78a1f, d46b544, f50f48c]:

    • @clerk/shared@4.35.0
    • @clerk/backend@3.20.0
    • @clerk/vue@2.5.5

@clerk/react@6.17.1

Patch Changes

@clerk/react-router@3.6.26

Patch Changes

@clerk/testing@2.2.38

Patch Changes

@clerk/vue@2.5.5

Patch Changes

@clerk/msw@0.0.72

Patch Changes

@clerk/swingset@0.0.49

Patch Changes

@vercel

vercel Bot commented Sep 23, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clerk-js-sandbox Ready Ready Preview Sep 24, 2026 7:01pm UTC
swingset Ready Ready Preview Sep 24, 2026 7:01pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Sep 23, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)
  • ci(repo): Version packages

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 893b8a5d-fb9f-4ed5-890b-1ab277d4d6a5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Sep 23, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9893

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9893

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9893

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9893

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9893

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9893

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9893

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9893

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9893

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9893

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9893

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9893

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9893

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9893

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@9893

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9893

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9893

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9893

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9893

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9893

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9893

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9893

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9893

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9893

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9893

commit: 1d1710b

@github-actions

github-actions Bot commented Sep 23, 2026 •

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-09-24T19:02:27.966Z

Summary

Metric Count
Packages analyzed 19
Packages with changes 0
🔴 Breaking changes 0
🟡 Non-breaking changes 0
🟢 Additions 0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 1d1710b.

This branch was successfully deployed

2 active deployments
Preview – swingset — 1d1710b3 Deployed Sep 24, 2026 by vercel[bot]
Preview – clerk-js-sandbox — 1d1710b3 Deployed Sep 24, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants