Update Clerk

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@clerk/backend (source)	3.15.0 → 3.17.1
@clerk/express (source)	2.1.49 → 2.1.66
@clerk/react (source)	6.12.10 → 6.15.0

---

Release Notes

clerk/javascript (@​clerk/backend)

v3.17.1

Compare Source

Patch Changes

• Updated dependencies [25d8633]:
  • @​clerk/shared@4.31.0

v3.17.0

Minor Changes

• Add experimental methods for sending and retrieving internal transactional emails, including Clerk suppression state and reasons. (#​9553) by @​jescalan

Patch Changes

• Reject JWT-template tokens presented as session tokens in the Authorization header when acceptsToken is 'any' or an array that includes 'session_token'. authenticateRequest() now returns a signed-out state with reason token-type-mismatch for such a token, matching the existing acceptsToken: 'session_token' behavior. (#​9511) by @​dominic-clerk

v3.16.13

Patch Changes

• Align JSDoc link targets with the docs link rules: internal docs links don't open in a new tab (removed {{ target: '_blank' }} from the Invitation Metadata link), while API reference links do (added it to the ExternalAccount Backend API link and the currentUser() endpoint link). (#​9556) by @​manovotny

• Updated dependencies [0d224f2]:

  • @​clerk/shared@4.30.2

v3.16.12

Compare Source

Patch Changes

• Updated dependencies [dbaa95a]:
  • @​clerk/shared@4.30.1

v3.16.11

Compare Source

Patch Changes

• Updated dependencies [28b77ac, 46bf7ce, 8bc1c9f, 17b865b]:
  • @​clerk/shared@4.30.0

v3.16.10

Compare Source

Patch Changes

• Mark the internal createBootstrapSignedOutState as deprecated. It is no longer used by @clerk/nextjs and is kept only for older published SDK versions. (#​9493) by @​djgould

• Updated dependencies [ea8cb05]:

  • @​clerk/shared@4.29.3

v3.16.9

Compare Source

Patch Changes

• Reject JWT-template tokens where a session or handshake token is expected. authenticateRequest() now returns a signed-out state with reason token-type-mismatch for such a token in the Authorization header or __session cookie. Tokens with no category tag, and instances configured to omit it, are unaffected. (#​9469) by @​dominic-clerk

v3.16.8

Compare Source

Patch Changes

• Scope the JWKS cache per Clerk instance. The cache was keyed on the JWT kid alone and shared across the whole process, so an application verifying tokens for more than one Clerk instance (for example the Dynamic Keys / multi-tenant pattern) could resolve a signing key that was fetched for a different instance. Keys are now cached separately per secret key and API URL, so a token can only be verified against the instance whose credentials fetched its signing key. (#​9394) by @​dominic-clerk

  Networkless verification with jwtKey had the same flaw: the JWK derived from the PEM was cached by kid alone, so a process verifying tokens with different jwtKey values could resolve a key derived from another instance's PEM. The JWK is now always derived from the jwtKey that was passed in.

  The jwk-kid-mismatch error message no longer lists the key IDs currently held in the cache.

v3.16.7

Compare Source

Patch Changes

• Fix Cookie header parsing in authenticateRequest() to follow RFC 6265 and guard against a non-string iss. Legitimate cookies and JWTs are unaffected. (#​9466) by @​dominic-clerk

• Updated dependencies [b815047]:

  • @​clerk/shared@4.29.2

v3.16.6

Compare Source

Patch Changes

• Updated dependencies [7f5c294]:
  • @​clerk/shared@4.29.1

v3.16.5

Compare Source

Patch Changes

• Billing applied-discount snapshots now include optional durationInCycles. Payment attempt and statement UIs use the original discount length instead of cycles remaining, and omit the duration copy when it is unavailable. (#​9401) by @​mauricioabreu

• Updated dependencies [81840b3, b7fb564, 44edcc9]:

  • @​clerk/shared@4.29.0

v3.16.4

Compare Source

Patch Changes

• Update the lockUser() documentation to link to the current Rules page in the Clerk Dashboard. (#​9372) by @​SarahSoutoul

v3.16.3

Compare Source

Patch Changes

• Updated dependencies [131edec]:
  • @​clerk/shared@4.28.1

v3.16.1

Patch Changes

• Use a root-relative link (/contact/support) for the passwordHasher "contact support" reference so the generated API reference renders it as an internal same-tab link instead of an external one. (#​9347) by @​manovotny

• Updated dependencies [34d278b]:

  • @​clerk/shared@4.27.1

v3.16.0

Minor Changes

• Add clerkClient.users.removePassword(userId, params?) to remove a user's password through the Backend API. Password removal is allowed even when the user has no alternate sign-in method configured. Existing sessions remain active by default; pass { signOutOfOtherSessions: true } to revoke them. (#​9326) by @​joshrowley

Patch Changes

• Improve generated API reference links, expose BillingSubscriptionItemStatus, and clarify the createUser() identification status documentation. (#​9340) by @​SarahSoutoul

• Updated dependencies [1ef84c3, d639048, a66cbbf]:

  • @​clerk/shared@4.27.0

v3.15.1

Patch Changes

• Add the optional emailAddressIdentificationStatus and phoneNumberIdentificationStatus parameters to CreateUserParams. The Backend API has supported these arrays on POST /v1/users since they shipped, but createUser() had no way to pass them, so every email address and phone number was necessarily created verified. Each array runs parallel to emailAddress / phoneNumber — one item per identifier, applied by position — and an item set to 'reserved' creates that identifier unverified but still usable for sign-in and locked so no other user can claim it. (#​9305) by @​dmoerner

  The createUser() documentation is corrected accordingly: it stated unconditionally that created email addresses and phone numbers are automatically verified, which is only the default.

• Updated dependencies [5c81479]:

  • @​clerk/shared@4.26.0

clerk/javascript (@​clerk/express)

v2.1.66

Compare Source

Patch Changes

• Updated dependencies [25d8633]:
  • @​clerk/shared@4.31.0
  • @​clerk/backend@3.17.1

v2.1.65

Patch Changes

• Updated dependencies [c4f9883, eef0ceb]:
  • @​clerk/backend@3.17.0

v2.1.64

Patch Changes

• Updated dependencies [9c5e93c, 0d224f2]:
  • @​clerk/backend@3.16.13
  • @​clerk/shared@4.30.2

v2.1.63

Compare Source

Patch Changes

• Updated dependencies [dbaa95a]:
  • @​clerk/shared@4.30.1
  • @​clerk/backend@3.16.12

v2.1.62

Compare Source

Patch Changes

• Updated dependencies [28b77ac, 46bf7ce, 8bc1c9f, 17b865b]:
  • @​clerk/shared@4.30.0
  • @​clerk/backend@3.16.11

v2.1.61

Compare Source

Patch Changes

• Updated dependencies [ea8cb05, f541dbf]:
  • @​clerk/shared@4.29.3
  • @​clerk/backend@3.16.10

v2.1.60

Compare Source

Patch Changes

• Updated dependencies [10615ea]:
  • @​clerk/backend@3.16.9

v2.1.59

Compare Source

Patch Changes

• Updated dependencies [4ebcff3]:
  • @​clerk/backend@3.16.8

v2.1.58

Compare Source

Patch Changes

• Updated dependencies [daae528, b815047]:
  • @​clerk/backend@3.16.7
  • @​clerk/shared@4.29.2

v2.1.57

Compare Source

Patch Changes

• Updated dependencies [7f5c294]:
  • @​clerk/shared@4.29.1
  • @​clerk/backend@3.16.6

v2.1.56

Compare Source

Patch Changes

• Updated dependencies [81840b3, b7fb564, 44edcc9]:
  • @​clerk/shared@4.29.0
  • @​clerk/backend@3.16.5

v2.1.55

Compare Source

Patch Changes

• Updated dependencies [167204b]:
  • @​clerk/backend@3.16.4

v2.1.54

Compare Source

Patch Changes

• Updated dependencies [131edec]:
  • @​clerk/shared@4.28.1
  • @​clerk/backend@3.16.3

v2.1.52

Patch Changes

• Updated dependencies [63d25ba, 34d278b]:
  • @​clerk/backend@3.16.1
  • @​clerk/shared@4.27.1

v2.1.51

Patch Changes

• Updated dependencies [1ef84c3, d639048, f38cf02, a66cbbf]:
  • @​clerk/backend@3.16.0
  • @​clerk/shared@4.27.0

v2.1.50

Patch Changes

• Respond with 400 Bad Request instead of surfacing a 500 when an incoming request cannot be represented as a fetch Request. Vulnerability-scanner probes such as hostless // request targets, targets that parse as credentialed URLs, and forbidden methods like TRACE previously threw inside the middleware and polluted error logs. (#​9290) by @​wobsoriano

• Updated dependencies [a601cd7, 5c81479]:

  • @​clerk/backend@3.15.1
  • @​clerk/shared@4.26.0

clerk/javascript (@​clerk/react)

v6.15.0

Minor Changes

• Add an authenticated OAuth device verification component and workflow hook for approving or denying OAuth Device Authorization Grant requests. (#​9518) by @​jeremy-clerk

Patch Changes

• Updated dependencies [25d8633]:
  • @​clerk/shared@4.31.0

v6.14.8

Patch Changes

• Updated dependencies [0d224f2]:
  • @​clerk/shared@4.30.2

v6.14.7

Compare Source

Patch Changes

• Fix an issue where a verification that was still progressing normally could be cancelled and reported to the user as having timed out. (#​9527) by @​zourzouvillys

• Updated dependencies [dbaa95a]:

  • @​clerk/shared@4.30.1

v6.14.6

Compare Source

Patch Changes

• Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in. (#​9497) by @​zourzouvillys

• Updated dependencies [28b77ac, 46bf7ce, 8bc1c9f, 17b865b]:

  • @​clerk/shared@4.30.0

v6.14.5

Compare Source

Patch Changes

• Updated dependencies [ea8cb05]:
  • @​clerk/shared@4.29.3

v6.14.4

Compare Source

Patch Changes

• Updated dependencies [b815047]:
  • @​clerk/shared@4.29.2

v6.14.3

Compare Source

Patch Changes

• Updated dependencies [7f5c294]:
  • @​clerk/shared@4.29.1

v6.14.2

Compare Source

Patch Changes

• Updated dependencies [81840b3, b7fb564, 44edcc9]:
  • @​clerk/shared@4.29.0

v6.14.1

Compare Source

Patch Changes

• Updated dependencies [131edec]:
  • @​clerk/shared@4.28.1

v6.13.1

Patch Changes

• Updated dependencies [34d278b]:
  • @​clerk/shared@4.27.1

v6.13.0

Minor Changes

• Add <InviteMembersButton />, a control component that opens the organization invite-members form in a modal when clicked, working like <SignInButton mode="modal">. (#​9124) by @​alexcarpenter

  Wrap your own button (or omit children for a default one). The button requires an active organization and should be rendered for members who can manage memberships (org:sys_memberships:manage). Opening it without an active organization or that permission is a no-op in production, and throws a descriptive error in development.

  import { InviteMembersButton } from '@clerk/nextjs';
  
  <InviteMembersButton>
    <button>Invite members</button>
  </InviteMembersButton>;

  This also adds Clerk.openInviteMembers() and Clerk.closeInviteMembers() for opening and closing the modal programmatically.

Patch Changes

• Fix a false-positive "multiple <ClerkProvider>" crash in apps that run more than one React root in a single JavaScript runtime, most commonly React Native Android apps during activity recreation. <ClerkProvider> now throws this error only when it is genuinely nested inside another <ClerkProvider>. (#​9335) by @​wobsoriano

• Updated dependencies [1ef84c3, d639048, a66cbbf]:

  • @​clerk/shared@4.27.0

v6.12.11

Patch Changes

• Allow ClerkProvider to omit publishableKey when it is supplied through VITE_CLERK_PUBLISHABLE_KEY or CLERK_PUBLISHABLE_KEY. (#​9314) by @​SarahSoutoul

• Updated dependencies [5c81479]:

  • @​clerk/shared@4.26.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.