Skip to content

ci(repo): Version packages - #9782

Open
clerk-cookie wants to merge 1 commit into
mainfrom
changeset-release/main
Open

clerk-cookie wants to merge 1 commit into
mainfrom
changeset-release/main

Conversation

@clerk-cookie

@clerk-cookie clerk-cookie commented Sep 16, 2026

Copy link
Copy Markdown
Collaborator

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@clerk/clerk-js@6.33.0

Minor Changes

  • Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away. (#9822) by @mauricioabreu

  • Add the ability for Organization admins to manage the SSO bypass allowlist from the Security page of <OrganizationProfile />. (#9809) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist exposes getUsers(), addUser({ userId }) and removeUser(userId).

Patch Changes

@clerk/localizations@4.18.0

Minor Changes

  • Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away. (#9822) by @mauricioabreu

  • Add the ability for Organization admins to manage the SSO bypass allowlist from the Security page of <OrganizationProfile />. (#9809) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist exposes getUsers(), addUser({ userId }) and removeUser(userId).

Patch Changes

  • Each enterprise connection listed on the organization Security page now opens its own page. It lists the connection name and domains, the service provider values to copy into the identity provider, the identity provider configuration behind an Edit form, and the connection settings as a form you save. The header carries one action, either Activate or Continue setup, and deactivating or removing the connection lives in a Danger zone section at the bottom of the page. The row menu is gone; click the row instead. (#9748) by @NicolasLopes7

    The setup wizard's domains step now shows a checkbox per verified domain, so an admin picks which domains a connection covers. A domain another connection of the organization already authenticates is disabled and labelled with that connection's name, and an error from creating the connection is shown on the provider step instead of being dropped.

    New customization handles ship with it: the organizationProfileSecuritySsoConnectionRow and organizationProfileSecuritySsoConnectionPage appearance elements, the configureSSOVerifyDomainCardCheckbox element, the claimed badge id, the new FieldId values for the connection settings, and the ssoConnectionName, ssoConnectionDomains, ssoConnectionServiceProvider, ssoConnectionIdentityProvider, ssoConnectionSettings and ssoConnectionDangerZone ProfileSectionId values.

  • Updated dependencies [804d3db, 64c8e3e, 07b4c2b, 4e36687, 9e7485c]:

    • @clerk/shared@4.34.0

@clerk/mosaic@0.1.0

Minor Changes

  • Add @clerk/mosaic, an experimental standalone package for next generation Clerk components. (#9765) by @Ephem

    If you try this out, make sure to pin your version as breaking changes can happen in minors.

  • Avatar now draws a 1px inset outline over its image and fallback so it keeps an edge against a matching background. Pass bordered={false} to Avatar.Root to drop it. (#9815) by @alexcarpenter

  • Export MosaicProvider to enable customizing messages and icons within the new components. (#9801) by @alexcarpenter

Patch Changes

  • Update link button to use underline position from font over hardcoded offset (#9796) by @maxyinger

  • Direction-aware icons (the forward chevrons on menu rows, the log-out arrow, and the previous/next arrows in paginated lists) now mirror horizontally when rendered under an ancestor with dir="rtl". (#9803) by @alexcarpenter

  • Updated dependencies [804d3db, 64c8e3e, 07b4c2b, 4e36687, 9e7485c]:

    • @clerk/shared@4.34.0

@clerk/react@6.17.0

Minor Changes

  • Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away. (#9822) by @mauricioabreu

Patch Changes

@clerk/shared@4.34.0

Minor Changes

  • Add @clerk/shared/phone with Clerk's country metadata and phone-number parsing, formatting, and detection helpers. (#9763) by @Ephem

  • Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away. (#9822) by @mauricioabreu

  • Add the ability for Organization admins to manage the SSO bypass allowlist from the Security page of <OrganizationProfile />. (#9809) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist exposes getUsers(), addUser({ userId }) and removeUser(userId).

  • Add createDynamicParamParser and populateParamFromObject to @clerk/shared/url for resolving :property placeholders in URL templates. (#9761) by @Ephem

Patch Changes

  • Each enterprise connection listed on the organization Security page now opens its own page. It lists the connection name and domains, the service provider values to copy into the identity provider, the identity provider configuration behind an Edit form, and the connection settings as a form you save. The header carries one action, either Activate or Continue setup, and deactivating or removing the connection lives in a Danger zone section at the bottom of the page. The row menu is gone; click the row instead. (#9748) by @NicolasLopes7

    The setup wizard's domains step now shows a checkbox per verified domain, so an admin picks which domains a connection covers. A domain another connection of the organization already authenticates is disabled and labelled with that connection's name, and an error from creating the connection is shown on the provider step instead of being dropped.

    New customization handles ship with it: the organizationProfileSecuritySsoConnectionRow and organizationProfileSecuritySsoConnectionPage appearance elements, the configureSSOVerifyDomainCardCheckbox element, the claimed badge id, the new FieldId values for the connection settings, and the ssoConnectionName, ssoConnectionDomains, ssoConnectionServiceProvider, ssoConnectionIdentityProvider, ssoConnectionSettings and ssoConnectionDangerZone ProfileSectionId values.

@clerk/ui@1.34.0

Minor Changes

  • Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away. (#9822) by @mauricioabreu

  • Add the ability for Organization admins to manage the SSO bypass allowlist from the Security page of <OrganizationProfile />. (#9809) by @mauricioabreu

    For custom flows, organization.ssoBypassAllowlist exposes getUsers(), addUser({ userId }) and removeUser(userId).

Patch Changes

  • Add @clerk/shared/phone with Clerk's country metadata and phone-number parsing, formatting, and detection helpers. (#9763) by @Ephem

  • Fix reconnecting disconnected Google One Tap accounts in UserProfile to use Google OAuth while preserving session reverification. (#9767) by @wobsoriano

  • Each enterprise connection listed on the organization Security page now opens its own page. It lists the connection name and domains, the service provider values to copy into the identity provider, the identity provider configuration behind an Edit form, and the connection settings as a form you save. The header carries one action, either Activate or Continue setup, and deactivating or removing the connection lives in a Danger zone section at the bottom of the page. The row menu is gone; click the row instead. (#9748) by @NicolasLopes7

    The setup wizard's domains step now shows a checkbox per verified domain, so an admin picks which domains a connection covers. A domain another connection of the organization already authenticates is disabled and labelled with that connection's name, and an error from creating the connection is shown on the provider step instead of being dropped.

    New customization handles ship with it: the organizationProfileSecuritySsoConnectionRow and organizationProfileSecuritySsoConnectionPage appearance elements, the configureSSOVerifyDomainCardCheckbox element, the claimed badge id, the new FieldId values for the connection settings, and the ssoConnectionName, ssoConnectionDomains, ssoConnectionServiceProvider, ssoConnectionIdentityProvider, ssoConnectionSettings and ssoConnectionDangerZone ProfileSectionId values.

  • Add @clerk/mosaic, an experimental standalone package for next generation Clerk components. (#9765) by @Ephem

    If you try this out, make sure to pin your version as breaking changes can happen in minors.

  • Add createDynamicParamParser and populateParamFromObject to @clerk/shared/url for resolving :property placeholders in URL templates. (#9761) by @Ephem

  • Updated dependencies [804d3db, 64c8e3e, 07b4c2b, 4e36687, 9e7485c]:

    • @clerk/shared@4.34.0
    • @clerk/localizations@4.18.0

@clerk/astro@4.1.4

Patch Changes

@clerk/backend@3.18.2

Patch Changes

@clerk/chrome-extension@3.1.85

Patch Changes

@clerk/electron@0.0.45

Patch Changes

@clerk/expo@4.6.9

Patch Changes

@clerk/expo-passkeys@2.0.21

Patch Changes

@clerk/express@2.1.70

Patch Changes

@clerk/fastify@3.1.80

Patch Changes

@clerk/hono@0.1.80

Patch Changes

@clerk/nextjs@7.9.5

Patch Changes

  • Fix a development-only React key warning when using ClerkProvider in the App Router. (#9816) by @joshrowley

  • Fix a cross-request credential leak in clerkMiddleware(). When using dynamic keys (an options callback that resolves a different secretKey per request), a clerkClient() call made inside the middleware handler could be built with another concurrent request's secret key. Each request now gets its own isolated store, so the keys resolved for a request are only ever visible to that request. (#9723) by @dominic-clerk

  • Updated dependencies [804d3db, 64c8e3e, 07b4c2b, 4e36687, 3d6ed25, 9e7485c]:

    • @clerk/shared@4.34.0
    • @clerk/react@6.17.0
    • @clerk/backend@3.18.2

@clerk/nuxt@3.1.4

Patch Changes

@clerk/react-router@3.6.25

Patch Changes

@clerk/tanstack-react-start@1.5.16

Patch Changes

@clerk/testing@2.2.37

Patch Changes

@clerk/vue@2.5.4

Patch Changes

@clerk/headless@0.0.35

Patch Changes

@clerk/msw@0.0.71

Patch Changes

@clerk/swingset@0.0.48

Patch Changes

@vercel

vercel Bot commented Sep 16, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clerk-js-sandbox Ready Ready Preview Sep 19, 2026 12:03am UTC
swingset Ready Ready Preview Sep 19, 2026 12:03am UTC

Request Review

@coderabbitai

coderabbitai Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)
  • ci(repo): Version packages

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a66e6537-b2dd-45dd-a4c9-e661d91153ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Sep 16, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9782

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9782

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9782

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9782

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9782

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9782

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9782

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9782

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9782

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9782

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9782

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9782

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9782

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9782

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@9782

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9782

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9782

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9782

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9782

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9782

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9782

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9782

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9782

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9782

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9782

commit: cedf72d

@github-actions

github-actions Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-09-19T00:04:43.470Z

Summary

Metric Count
Packages analyzed 19
Packages with changes 0
🔴 Breaking changes 0
🟡 Non-breaking changes 0
🟢 Additions 0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on cedf72d.

@NicolasLopes7
NicolasLopes7 enabled auto-merge (squash) September 16, 2026 21:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant