@clerk/expo@3.7.8

Patch Changes

• Reduce redundant native and JavaScript client refreshes during Expo startup. (#9140) by @mikepitre

@clerk/electron@0.0.16

Patch Changes

• Validate that token-cache and OAuth-transport IPC requests originate from a top-level window's main frame. This prevents untrusted content in subframes or <webview>s that share the Clerk preload from reading the persisted client JWT or driving the OAuth transport. (#9167) by @dominic-clerk

@clerk/vue@2.4.17

Patch Changes

• Updated dependencies [bcbdda6]:
  • @clerk/shared@4.25.5

@clerk/ui@1.25.5

Patch Changes

• Fix pressing Escape while a Select is open inside a Drawer (for example the payment method picker in Checkout) dismissing the entire Drawer. Escape now closes only the open Select and leaves the Drawer open. The Select now wires up its floating interaction props so it handles Escape itself, and the Drawer roots a floating tree so nested floating elements are recognized as its children. (#9176) by @alexcarpenter

• Improve Select keyboard and screen reader support by routing navigation through floating-ui's interaction hooks. Pressing ArrowUp/ArrowDown on a focused, closed Select now opens the listbox, and the active option is announced via aria-activedescendant. The searchable variant (for example the PhoneInput country picker) now exposes a proper combobox: its input is marked role="combobox" with aria-controls, aria-autocomplete="list", and aria-activedescendant, while the plain variant keeps its listbox semantics. (#9179) by @alexcarpenter

• Updated dependencies [bcbdda6]:

  • @clerk/shared@4.25.5
  • @clerk/localizations@4.13.5

@clerk/testing@2.2.10

Patch Changes

• Updated dependencies [bcbdda6, e657d99]:
  • @clerk/shared@4.25.5
  • @clerk/backend@3.11.7

@clerk/tanstack-react-start@1.4.20

Patch Changes

• Escape <, >, and / when serializing the Clerk auth state into SSR <script> tags, preventing a </script> sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. (#9166) by @dominic-clerk

• Updated dependencies [bcbdda6, e657d99]:

  • @clerk/shared@4.25.5
  • @clerk/backend@3.11.7
  • @clerk/react@6.12.5

@clerk/shared@4.25.5

Patch Changes

• Escape <, >, and / when serializing the Clerk auth state into SSR <script> tags, preventing a </script> sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. (#9166) by @dominic-clerk

@clerk/react@6.12.5

Patch Changes

• Updated dependencies [bcbdda6]:
  • @clerk/shared@4.25.5

@clerk/react-router@3.5.12

Patch Changes

• Updated dependencies [bcbdda6, e657d99]:
  • @clerk/shared@4.25.5
  • @clerk/backend@3.11.7
  • @clerk/react@6.12.5

@clerk/nuxt@2.6.19

Patch Changes

• Updated dependencies [bcbdda6, e657d99]:
  • @clerk/shared@4.25.5
  • @clerk/backend@3.11.7
  • @clerk/vue@2.4.17