[clerk-cookie]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@clerk/mosaic@0.2.0

Minor Changes

• Breaking: Replace and remove color tokens. TypeScript does not flag these, so find usages with git grep -nE -e '--cl-color-(background|brand-secondary)'. (#10493) by @prestonwebdev

  Before	After
  --cl-color-background	--cl-color-page for the profile shell, --cl-color-surface for anything raised on it, such as cards, menus and controls
  --cl-color-background-subtle	--cl-color-surface-subtle
  --cl-color-brand-secondary	Removed, with no direct replacement. Choose another token by where it is used.

  Dark mode gives the profile its own shell color. --cl-color-background is replaced by --cl-color-page, the base layer (near-black in dark mode, white in light), which backs the profile shell. A new --cl-color-surface backs everything raised on it, such as cards, sections, menus, popovers and controls, and the gray ramp mixes into it. The surface is derived from the page (neutral mixed 5 percent into it in dark mode, white mixed 60 percent into it in light mode), so retinting --cl-color-page retints the shell, the surface and the ramp together, and with the default white page the shell, surface and borders look the same in light mode. --cl-color-background-subtle is renamed --cl-color-surface-subtle.

  Brand and the negative, positive and warning colors now share one set of derived tokens: -foreground, -subtle, -border and -alpha-100|200|300, so overriding a seed retints its companions. -foreground flips to dark text in dark mode for brand, positive and warning, where white would fail, while negative keeps white text. --cl-color-brand-secondary is removed. --cl-color-neutral-subtle is new. --cl-color-border and --cl-color-border-subtle are now neutral washes (7 and 4 percent in light mode, 12 and 8 in dark mode), so they stay visible on the surface and faded fills.

  In light mode the negative, positive and warning colors are slightly darker so their text passes contrast on their own -subtle fill, --cl-color-foreground-secondary is a little darker, and --cl-color-input-placeholder has its own value that now passes contrast on the field.

• Breaking: Nest localization keys under the component they appear in, for example userProfileMfa.label is now userProfile.mfa.label. Update any localization overrides that use the old keys, written as nested objects or dot paths; TypeScript flags each one. Keys below a root stay the same unless listed here. (#10458) by @alexcarpenter

  Before	After
  apiKeysTable	apiKeys
  membersTableTab	organizationProfile.members.list
  invitationsTableTab	organizationProfile.members.invitations
  requestsTableTab	organizationProfile.members.requests
  organizationProfileInviteMembers	organizationProfile.members.invite
  organizationProfileProfileSection	organizationProfile.profile
  organizationProfileDangerSection	organizationProfile.danger
  userProfileProfileSection	userProfile.profile
  userProfileContact	userProfile.contact
  userProfileContact.email	userProfile.email
  userProfileContact.phone	userProfile.phone
  userProfileAddEmail	userProfile.email.addDialog
  userProfileAddPhone	userProfile.phone.addDialog
  userProfileConnectedAccounts	userProfile.connectedAccounts
  userProfileEnterpriseAccountsSection	userProfile.enterpriseAccounts
  userProfileWeb3Wallets	userProfile.web3Wallets
  userProfilePasswordSection	userProfile.password
  userProfilePasskeys	userProfile.passkeys
  userProfileMfa	userProfile.mfa
  userProfileAddSms	userProfile.mfa.addSms
  userProfileAddAuthenticator	userProfile.mfa.addAuthenticator
  userProfileAuthenticatorSetup	userProfile.mfa.authenticatorSetup
  userProfileBackupCodes	userProfile.mfa.backupCodes
  userProfileActiveDevices	userProfile.activeDevices
  userProfileDangerSection	userProfile.danger

  Keys under reverification are also renamed:

  Before	After
  alternativeMethods.title, .description	methods.title, .description
  alternativeMethods.blockButton__<method>	methods.<method>
  alternativeMethods.actionText	methods.helpText
  alternativeMethods.actionLink	methods.help
  alternativeMethods.getHelp.title, .description	help.title, .description
  alternativeMethods.getHelp.blockButton__emailSupport	help.emailSupport
  backupCodeMfa.*	backupCode.*
  formFieldLabel__backupCode	backupCode.label
  formFieldLabel__password	password.label
  formFieldInputPlaceholder__password	password.placeholder
  formFieldAction__showPassword, formFieldAction__hidePassword	password.showPassword, .hidePassword
  emailCode.formTitle, phoneCode.formTitle, totpMfa.formTitle	emailCode.label, phoneCode.label, totp.label
  emailCode.resendButton, phoneCode.resendButton	emailCode.resend, phoneCode.resend
  totpMfa.title, .description	totp.title, .description
  phoneCodeMfa.*	phoneCode.*, with the renames above
  error.closeButton	error.close
  backButton	back
  formButtonPrimary	continue
  footerActionLink__useAnotherMethod	useAnotherMethod
  unstable__errors__generic	attemptFailed
  passkey.blockButton__passkey, password.actionLink, formButtonReset, identityPreviewEditButton__*	Removed. Delete the override.

  Find usages with:

  git grep -nE -e 'apiKeysTable|(members|invitations|requests)TableTab|organizationProfile(InviteMembers|DangerSection|ProfileSection)' \
    -e 'userProfile(ActiveDevices|AddEmail|AddPhone|AddAuthenticator|AddSms|AuthenticatorSetup|BackupCodes|ConnectedAccounts|Contact|DangerSection|EnterpriseAccountsSection|Mfa|Passkeys|PasswordSection|ProfileSection|Web3Wallets)'

• Breaking: Rename two UserButton and OrganizationSwitcher props. Values and defaults are unchanged; TypeScript flags each old name. (#10554) by @alexcarpenter

  Before	After
  renderTriggerLabel	showTriggerLabel
  renderTriggerBadge	triggerBadge

  Find usages with git grep -nE 'renderTrigger(Label|Badge)'.

Patch Changes

• Fix hover-enabled menus, such as the UserButton account and settings flyouts, sometimes closing when the pointer moved toward an item after the menu was opened with a click. (#10533) by @alexcarpenter

• Fix the user profile modal's return from a redirect on Next.js App Router apps: the URL change now reaches the router, so useSearchParams no longer keeps the removed param and going back no longer reloads the page. History state that isn't a plain object is also kept intact. (#10550) by @alexcarpenter

• Ellipsis menus, the dialog and card close buttons, the Cancel buttons in the confirmation, delete and rename dialogs, and the reverification Back button and resend and help links use the neutral color instead of the brand color, and the "You" badge in the members table is neutral. Field labels use the neutral text color, and disabled inputs and tag inputs are tinted with the neutral color. Email and phone values in the user profile use the primary text color. An interactive row's icon darkens fully on hover, and an outlined interactive row firms up its border on hover. (#10494) by @prestonwebdev

• The user profile modal now reopens on the Account page after a user leaves it to connect or reconnect a social or enterprise account, or to verify an email address through enterprise SSO. Mosaic no longer sends __clerk_modal_state on these redirects, so returning from them no longer opens the legacy profile modal. (#10545) by @alexcarpenter

• Suppress organization invitation success notifications when the members panel closes or the active organization or session changes before the invitation finishes. (#10551) by @austincalvelage

• Updated dependencies [debfc72]:

  • @clerk/shared@4.43.1

@clerk/astro@4.1.20

Patch Changes

• Updated dependencies [cd21ebe, 11907aa, debfc72]:
  • @clerk/backend@3.26.5
  • @clerk/shared@4.43.1

@clerk/backend@3.26.5

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• Add bcrypt_peppered, md5_salted, pbkdf2_sha512, pbkdf2_sha512_hex, sha256_salted, and sha512_symfony to the PasswordHasher type, so TypeScript accepts every hasher the createUser() JSDoc documents. The JSDoc for md5_salted and sha256_salted now also shows the password_digest format the Backend API accepts: hash$salt, not salt$hash. (#10504) by @manovotny

• Updated dependencies [debfc72]:

  • @clerk/shared@4.43.1

@clerk/chrome-extension@3.1.103

Patch Changes

• Updated dependencies [cd21ebe, 690edf2, debfc72, 1bce44b]:
  • @clerk/react@6.18.4
  • @clerk/clerk-js@6.42.1
  • @clerk/shared@4.43.1
  • @clerk/ui@1.42.2

@clerk/clerk-js@6.42.1

Patch Changes

• Keep a Device Intelligence result that arrives after ClerkJS has stopped waiting for it, and use it for the next sign-in or sign-up instead of discarding it. Users on slow connections who retry are less likely to have sign-ups blocked by protections that require a Device Intelligence result. (#10276) by @mwickett

• Wait up to 10 seconds, instead of 5, for the Device Intelligence check to finish before sending a sign-in or sign-up without its result. This applies when an instance hasn't configured its own limit. Users on slow connections are less likely to have sign-ups blocked by protections that require a Device Intelligence result. (#10275) by @mwickett

  Keep the wait bounded when the device clock changes so later attempts can recover after another tab's lock is released.

  The shared loader type reference now documents the same 10-second default.

• Fix getToken() returning an expired session token when the device clock runs behind and a token is cached again, or a staler token arrives after a fresher one. (#10429) by @Ephem

• Updated dependencies [debfc72]:

  • @clerk/shared@4.43.1

@clerk/electron@0.1.8

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• The token file written by storage() from @clerk/electron/storage is now readable and writable only by its owner (0600). It was previously world-readable (0644 under the default umask). Existing token files are updated the next time storage() is called. (#9971) by @wobsoriano

• Updated dependencies [cd21ebe, 690edf2, debfc72, 1bce44b]:

  • @clerk/react@6.18.4
  • @clerk/clerk-js@6.42.1
  • @clerk/shared@4.43.1

@clerk/expo@4.14.5

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• Updated dependencies [cd21ebe, 690edf2, debfc72, 1bce44b]:

  • @clerk/react@6.18.4
  • @clerk/clerk-js@6.42.1
  • @clerk/shared@4.43.1

@clerk/expo-native-components@0.4.3

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

@clerk/expo-passkeys@2.1.5

Patch Changes

• Updated dependencies [debfc72]:
  • @clerk/shared@4.43.1

@clerk/express@2.1.86

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• Updated dependencies [cd21ebe, 11907aa, debfc72]:

  • @clerk/backend@3.26.5
  • @clerk/shared@4.43.1

@clerk/fastify@3.1.96

Patch Changes

• Updated dependencies [cd21ebe, 11907aa, debfc72]:
  • @clerk/backend@3.26.5
  • @clerk/shared@4.43.1

@clerk/hono@0.1.96

Patch Changes

• Updated dependencies [cd21ebe, 11907aa, debfc72]:
  • @clerk/backend@3.26.5
  • @clerk/shared@4.43.1

@clerk/localizations@4.24.4

Patch Changes

• Use future tense for nl-NL and nl-BE translations (#10507) by @wobsoriano

• Updated dependencies [debfc72]:

  • @clerk/shared@4.43.1

@clerk/nextjs@7.9.23

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• Updated dependencies [cd21ebe, 11907aa, debfc72]:

  • @clerk/backend@3.26.5
  • @clerk/react@6.18.4
  • @clerk/shared@4.43.1

@clerk/nuxt@3.1.20

Patch Changes

• Updated dependencies [cd21ebe, 11907aa, debfc72]:
  • @clerk/backend@3.26.5
  • @clerk/shared@4.43.1
  • @clerk/vue@2.5.17

@clerk/react@6.18.4

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• Updated dependencies [debfc72]:

  • @clerk/shared@4.43.1

@clerk/react-router@3.6.41

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• Updated dependencies [cd21ebe, 11907aa, debfc72]:

  • @clerk/backend@3.26.5
  • @clerk/react@6.18.4
  • @clerk/shared@4.43.1

@clerk/shared@4.43.1

Patch Changes

• Wait up to 10 seconds, instead of 5, for the Device Intelligence check to finish before sending a sign-in or sign-up without its result. This applies when an instance hasn't configured its own limit. Users on slow connections are less likely to have sign-ups blocked by protections that require a Device Intelligence result. (#10275) by @mwickett

  Keep the wait bounded when the device clock changes so later attempts can recover after another tab's lock is released.

  The shared loader type reference now documents the same 10-second default.

@clerk/tanstack-react-start@1.7.9

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @dominic-clerk

• Updated dependencies [cd21ebe, 11907aa, debfc72]:

  • @clerk/backend@3.26.5
  • @clerk/react@6.18.4
  • @clerk/shared@4.43.1

@clerk/testing@2.2.53

Patch Changes

• Updated dependencies [cd21ebe, 11907aa, debfc72]:
  • @clerk/backend@3.26.5
  • @clerk/shared@4.43.1

@clerk/ui@1.42.2

Patch Changes

• Updated dependencies [83c06bb, debfc72]:
  • @clerk/localizations@4.24.4
  • @clerk/shared@4.43.1

@clerk/upgrade@2.0.10

Patch Changes

• Correct Core 3 upgrade guide entries: the idPOAuthAccessToken property name in the backend verify example is fixed, @clerk/react-router/api.server is described as deprecated (still exported) instead of removed, and the Expo minimum version check now flags caret ranges such as "expo": "^52.1.0". (#10298) by @royanger

@clerk/vue@2.5.17

Patch Changes

• Updated dependencies [debfc72]:
  • @clerk/shared@4.43.1

@clerk/msw@0.0.84

Patch Changes

• Updated dependencies [debfc72]:
  • @clerk/shared@4.43.1

@clerk/swingset@0.0.67

Patch Changes

• Updated dependencies [cd21ebe, 289710f, cd970b7, 9f579d3, 8619030, cf438ed, 5e6101b, a7e5619, debfc72, 9f0874e]:
  • @clerk/nextjs@7.9.23
  • @clerk/mosaic@0.2.0
  • @clerk/shared@4.43.1

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 30, 2026 8:03pm UTC
swingset	Ready	Preview	Oct 30, 2026 8:03pm UTC

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 1

• ci(repo): Version packages

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: clerk/javascript
• Branch: changeset-release/main
• File: .coderabbit.yaml
• Commit: 7d90c9e
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 38b21ee7-514f-4630-89b7-aec531d432cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10475

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10475

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10475

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10475

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10475

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10475

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10475

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10475

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10475

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10475

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10475

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10475

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10475

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10475

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10475

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10475

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10475

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10475

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10475

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10475

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10475

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10475

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10475

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10475

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10475

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10475

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10475

commit: 7d90c9e

[github-actions]

API Changes Report

Generated by Break Check on 2026-10-30T20:03:46.696Z

Summary

Metric	Count
Packages analyzed	20
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 7d90c9e.}

[github-actions]

🟢 e2e android: 16 passed

All 16 tests in 12 files

	Test	Time
🟢	specs/features/custom-flow-sign-in/complete.e2e.ts · 1 passed	18.1s
🟢	useSignIn completes with the email code	18.1s
🟢	specs/features/custom-flow-sign-up/complete.e2e.ts · 1 passed	18.7s
🟢	useSignUp completes with the email code	18.7s
🟢	specs/features/native-auth-view/complete.e2e.ts · 1 passed	17.2s
🟢	signs in through AuthView with the email code	17.2s
🟢	specs/features/native-auth-view/logo.e2e.ts · 1 passed	20.2s
🟢	signs in with a password through the AuthView that has a logo, after it closed and reopened	20.2s
🟢	specs/features/native-auth-view/opens.e2e.ts · 2 passed	10.3s
🟢	the home full-screen sign-in button shows AuthView with no close button	3.9s
🟢	closing the AuthView that the home opened returns to the home	6.4s
🟢	specs/features/native-js-sync/sign-in-from-native.e2e.ts · 2 passed	45.1s
🟢	a native password sign-in reaches the JS hooks and survives a relaunch	21.0s
🟢	a second native sign-in in the same process reaches the JS hooks	24.1s
🟢	specs/features/native-js-sync/sign-out-from-native.e2e.ts · 1 passed	8.9s
🟢	signing out in the native profile signs out the JS hooks	8.9s
🟢	specs/features/native-modules/biometric-availability.e2e.ts · 1 passed	6.2s
🟢	useBiometricCredentials reports what the expo-biometrics native module found on the device	6.2s
🟢	specs/features/native-modules/google-sign-in.e2e.ts · 1 passed	13.1s
🟢	useSignInWithGoogle opens the native Google sign-in, and cancelling it ends the flow with no session	13.1s
🟢	specs/features/token-cache-persistence/relaunch.e2e.ts · 1 passed	13.0s
🟢	the token cache keeps the session across a relaunch, and a new scope starts signed out	13.0s
🟢	specs/features/user-button-and-profile/embedded-profile.e2e.ts · 2 passed	14.8s
🟢	onHostBack closes the embedded profile after native navigation	8.9s
🟢	a custom page renders React Native content inside the embedded profile	5.9s
🟢	specs/features/user-button-and-profile/profile.e2e.ts · 2 passed	16.7s
🟢	the home UserButton opens the profile of the signed-in user	8.4s
🟢	the home sign-out button ends the session	8.3s

_{e2e 0.18.0 · 3m 25s · android · run artifacts}

[github-actions]

🟢 e2e ios: 17 passed

All 17 tests in 12 files

	Test	Time
🟢	specs/features/custom-flow-sign-in/complete.e2e.ts · 1 passed	25.3s
🟢	useSignIn completes with the email code	25.3s
🟢	specs/features/custom-flow-sign-up/complete.e2e.ts · 1 passed	31.7s
🟢	useSignUp completes with the email code	31.7s
🟢	specs/features/native-auth-view/complete.e2e.ts · 1 passed	22.7s
🟢	signs in through AuthView with the email code	22.7s
🟢	specs/features/native-auth-view/logo.e2e.ts · 1 passed	40.4s
🟢	signs in with a password through the AuthView that has a logo, after it closed and reopened	40.4s
🟢	specs/features/native-auth-view/opens.e2e.ts · 3 passed	14.1s
🟢	the home full-screen sign-in button shows AuthView with no close button	3.3s
🟢	closing the AuthView that the home opened returns to the home	6.2s
🟢	the close button of a full-screen AuthView returns to the home	4.6s
🟢	specs/features/native-js-sync/sign-in-from-native.e2e.ts · 2 passed	1m 47s
🟢	a native password sign-in reaches the JS hooks and survives a relaunch	39.9s
🟢	a second native sign-in in the same process reaches the JS hooks	1m 7s
🟢	specs/features/native-js-sync/sign-out-from-native.e2e.ts · 1 passed	6.9s
🟢	signing out in the native profile signs out the JS hooks	6.9s
🟢	specs/features/native-modules/biometric-availability.e2e.ts · 1 passed	4.3s
🟢	useBiometricCredentials reports what the expo-biometrics native module found on the device	4.3s
🟢	specs/features/native-modules/google-sign-in.e2e.ts · 1 passed	11.5s
🟢	useSignInWithGoogle opens the native Google sign-in, and cancelling it ends the flow with no session	11.5s
🟢	specs/features/token-cache-persistence/relaunch.e2e.ts · 1 passed	13.7s
🟢	the token cache keeps the session across a relaunch, and a new scope starts signed out	13.7s
🟢	specs/features/user-button-and-profile/embedded-profile.e2e.ts · 2 passed	13.8s
🟢	onHostBack closes the embedded profile after native navigation	7.4s
🟢	a custom page renders React Native content inside the embedded profile	6.4s
🟢	specs/features/user-button-and-profile/profile.e2e.ts · 2 passed	14.2s
🟢	the home UserButton opens the profile of the signed-in user	8.1s
🟢	the home sign-out button ends the session	6.2s

_{e2e 0.18.0 · 5m 8s · ios · run artifacts}