ci(repo): Version packages

[clerk-cookie]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@clerk/clerk-js@6.28.0

Minor Changes

• Add support for manual discounts and promo codes. Discounts, whether manual or via a promo code, are shown in the subscriptions list and in payments/statements. Promo codes can now be entered at checkout. (#9316) by @dstaley

• Add a way to supply a Clerk Protect assertion from your application, so a token minted by your own backend reaches Protect without your having to set a cookie. (#9313) by @zourzouvillys

  A Protect assertion is a short-lived, signed token you create with the Clerk Backend API, carrying key/value pairs your Protect rules can read. Until now the only way to deliver one was the __clerk_protect_assertion cookie, which requires your app and Frontend API to be on the same site — true with a production CNAME setup, but not on development instances.

  Pass the token to Clerk and it is attached to sign-in and sign-up requests instead:

  // A token you already have.
  Clerk.load({ protectAssertion: token });
  
  // Or a function, re-read for each request.
  Clerk.load({ protectAssertion: () => sessionStorage.getItem('protect_assertion') ?? undefined });
  
  // Or set it later, once your app has fetched one.
  clerk.setProtectAssertion(token);

  Prefer the function form when a page can outlive the token. Assertions are short-lived by design, so a string captured at load time stops applying once it expires, whereas a function picks up a refreshed one.

  An assertion is an input to rules you author, never a decision on its own, and it applies only from the context you constrained it to when you minted it. Nothing about it can fail a sign-in: a resolver that throws, rejects, or returns anything other than a non-empty string simply results in no assertion being attached, and the request proceeds.

  The cookie continues to work unchanged. If both are present, the value supplied to the SDK wins.

Patch Changes

• Keep the freshest session token when a server response carries an older one. A slow response, or the client payload attached to one, could previously roll lastActiveToken back to a stale token, which is the token sent as the previous-token hint on the next token request. (#9284) by @nikosdouvlis

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:

  • @clerk/shared@4.28.0

@clerk/localizations@4.15.0

Minor Changes

• Add support for manual discounts and promo codes. Discounts, whether manual or via a promo code, are shown in the subscriptions list and in payments/statements. Promo codes can now be entered at checkout. (#9316) by @dstaley

Patch Changes

• Make OAuth consent screens clearly identify private metadata as potentially sensitive information set by the Clerk application. (#9226) by @jescalan

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:

  • @clerk/shared@4.28.0

@clerk/react@6.14.0

Minor Changes

• Add a way to supply a Clerk Protect assertion from your application, so a token minted by your own backend reaches Protect without your having to set a cookie. (#9313) by @zourzouvillys

  A Protect assertion is a short-lived, signed token you create with the Clerk Backend API, carrying key/value pairs your Protect rules can read. Until now the only way to deliver one was the __clerk_protect_assertion cookie, which requires your app and Frontend API to be on the same site — true with a production CNAME setup, but not on development instances.

  Pass the token to Clerk and it is attached to sign-in and sign-up requests instead:

  // A token you already have.
  Clerk.load({ protectAssertion: token });
  
  // Or a function, re-read for each request.
  Clerk.load({ protectAssertion: () => sessionStorage.getItem('protect_assertion') ?? undefined });
  
  // Or set it later, once your app has fetched one.
  clerk.setProtectAssertion(token);

  Prefer the function form when a page can outlive the token. Assertions are short-lived by design, so a string captured at load time stops applying once it expires, whereas a function picks up a refreshed one.

  An assertion is an input to rules you author, never a decision on its own, and it applies only from the context you constrained it to when you minted it. Nothing about it can fail a sign-in: a resolver that throws, rejects, or returns anything other than a non-empty string simply results in no assertion being attached, and the request proceeds.

  The cookie continues to work unchanged. If both are present, the value supplied to the SDK wins.

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0

@clerk/shared@4.28.0

Minor Changes

• Add support for manual discounts and promo codes. Discounts, whether manual or via a promo code, are shown in the subscriptions list and in payments/statements. Promo codes can now be entered at checkout. (#9316) by @dstaley

• Add a way to supply a Clerk Protect assertion from your application, so a token minted by your own backend reaches Protect without your having to set a cookie. (#9313) by @zourzouvillys

  A Protect assertion is a short-lived, signed token you create with the Clerk Backend API, carrying key/value pairs your Protect rules can read. Until now the only way to deliver one was the __clerk_protect_assertion cookie, which requires your app and Frontend API to be on the same site — true with a production CNAME setup, but not on development instances.

  Pass the token to Clerk and it is attached to sign-in and sign-up requests instead:

  // A token you already have.
  Clerk.load({ protectAssertion: token });
  
  // Or a function, re-read for each request.
  Clerk.load({ protectAssertion: () => sessionStorage.getItem('protect_assertion') ?? undefined });
  
  // Or set it later, once your app has fetched one.
  clerk.setProtectAssertion(token);

  Prefer the function form when a page can outlive the token. Assertions are short-lived by design, so a string captured at load time stops applying once it expires, whereas a function picks up a refreshed one.

  An assertion is an input to rules you author, never a decision on its own, and it applies only from the context you constrained it to when you minted it. Nothing about it can fail a sign-in: a resolver that throws, rejects, or returns anything other than a non-empty string simply results in no assertion being attached, and the request proceeds.

  The cookie continues to work unchanged. If both are present, the value supplied to the SDK wins.

Patch Changes

• Make OAuth consent screens clearly identify private metadata as potentially sensitive information set by the Clerk application. (#9226) by @jescalan

@clerk/ui@1.30.0

Minor Changes

• Add support for manual discounts and promo codes. Discounts, whether manual or via a promo code, are shown in the subscriptions list and in payments/statements. Promo codes can now be entered at checkout. (#9316) by @dstaley

Patch Changes

• Make OAuth consent screens clearly identify private metadata as potentially sensitive information set by the Clerk application. (#9226) by @jescalan

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:

  • @clerk/localizations@4.15.0
  • @clerk/shared@4.28.0

@clerk/astro@4.0.9

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/backend@3.16.2

@clerk/backend@3.16.2

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0

@clerk/chrome-extension@3.1.68

Patch Changes

• Updated dependencies [aa86d9f, 8c61153, 52ec5cd, 6464fe7]:
  • @clerk/clerk-js@6.28.0
  • @clerk/shared@4.28.0
  • @clerk/ui@1.30.0
  • @clerk/react@6.14.0

@clerk/electron@0.0.29

Patch Changes

• Updated dependencies [aa86d9f, 8c61153, 52ec5cd, 6464fe7]:
  • @clerk/clerk-js@6.28.0
  • @clerk/shared@4.28.0
  • @clerk/react@6.14.0

@clerk/expo@4.2.4

Patch Changes

• Keep a cached environment when the app starts offline and only the client cache is empty. Previously both resources fell back to placeholder data, so instance settings were lost until the app was restarted with a working network. (#9284) by @nikosdouvlis

  Repeated unauthenticated responses now share one native recovery attempt within a few seconds of each other, instead of reading native state and refetching the client for every response.

  Fix the tokenCache prop documentation: the cache stores the client JWT, not the session token.

• Updated dependencies [aa86d9f, 8c61153, 52ec5cd, 6464fe7]:

  • @clerk/clerk-js@6.28.0
  • @clerk/shared@4.28.0
  • @clerk/react@6.14.0

@clerk/expo-passkeys@2.0.8

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0

@clerk/express@2.1.53

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/backend@3.16.2

@clerk/fastify@3.1.63

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/backend@3.16.2

@clerk/hono@0.1.63

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/backend@3.16.2

@clerk/nextjs@7.7.2

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/react@6.14.0
  • @clerk/backend@3.16.2

@clerk/nuxt@3.0.5

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/backend@3.16.2
  • @clerk/vue@2.4.26

@clerk/react-router@3.6.7

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/react@6.14.0
  • @clerk/backend@3.16.2

@clerk/tanstack-react-start@1.4.30

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/react@6.14.0
  • @clerk/backend@3.16.2

@clerk/testing@2.2.20

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0
  • @clerk/backend@3.16.2

@clerk/vue@2.4.26

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0

@clerk/headless@0.0.22

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0

@clerk/msw@0.0.58

Patch Changes

• Updated dependencies [aa86d9f, 52ec5cd, 6464fe7]:
  • @clerk/shared@4.28.0

@clerk/swingset@0.0.32

Patch Changes

• Updated dependencies [aa86d9f, 6464fe7]:
  • @clerk/ui@1.30.0
  • @clerk/headless@0.0.22

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Aug 10, 2026 7:56pm
swingset	Ready	Preview	Aug 10, 2026 7:56pm

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9368

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9368

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9368

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9368

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9368

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9368

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9368

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9368

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9368

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9368

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9368

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9368

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9368

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9368

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9368

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9368

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9368

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9368

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9368

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9368

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9368

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9368

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9368

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9368

commit: 6c41c70

[github-actions]

API Changes Report

Generated by Break Check on 2026-08-10T19:57:41.863Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 6c41c70.}