clerk · clerk-cookie · Jul 31, 2026
diff --git a/.changeset/backend-create-user-identification-status.md b/.changeset/backend-create-user-identification-status.md
diff --git a/.changeset/duplicate-session-cookies.md b/.changeset/duplicate-session-cookies.md
diff --git a/.changeset/expo-native-e2e-fixes.md b/.changeset/expo-native-e2e-fixes.md
diff --git a/.changeset/harden-request-conversion.md b/.changeset/harden-request-conversion.md
diff --git a/.changeset/mosaic-button-icon-color.md b/.changeset/mosaic-button-icon-color.md
diff --git a/.changeset/mosaic-card-stylex.md b/.changeset/mosaic-card-stylex.md
diff --git a/.changeset/mosaic-render-props.md b/.changeset/mosaic-render-props.md
diff --git a/.changeset/rare-pumas-repeat.md b/.changeset/rare-pumas-repeat.md
diff --git a/.changeset/smart-jars-repeat.md b/.changeset/smart-jars-repeat.md
diff --git a/packages/astro/CHANGELOG.md b/packages/astro/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @clerk/astro
 
+## 4.0.6
+
+### Patch Changes
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 4.0.5
 
 ### Patch Changes

diff --git a/packages/astro/package.json b/packages/astro/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/astro",
-  "version": "4.0.5",
+  "version": "4.0.6",
   "description": "Clerk SDK for Astro",
   "keywords": [
     "auth",

diff --git a/packages/backend/CHANGELOG.md b/packages/backend/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Change Log
 
+## 3.15.1
+
+### Patch Changes
+
+- Add the optional `emailAddressIdentificationStatus` and `phoneNumberIdentificationStatus` parameters to `CreateUserParams`. The Backend API has supported these arrays on `POST /v1/users` since they shipped, but `createUser()` had no way to pass them, so every email address and phone number was necessarily created verified. Each array runs parallel to `emailAddress` / `phoneNumber` — one item per identifier, applied by position — and an item set to `'reserved'` creates that identifier unverified but still usable for sign-in and locked so no other user can claim it. ([#9305](https://github.com/clerk/javascript/pull/9305)) by [@dmoerner](https://github.com/dmoerner)
+
+  The `createUser()` documentation is corrected accordingly: it stated unconditionally that created email addresses and phone numbers are automatically verified, which is only the default.
+
 ## 3.15.0
 
 ### Minor Changes

diff --git a/packages/backend/package.json b/packages/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/backend",
-  "version": "3.15.0",
+  "version": "3.15.1",
   "description": "Clerk Backend SDK - REST Client for Backend API & JWT verification utilities",
   "homepage": "https://clerk.com/",
   "bugs": {

diff --git a/packages/chrome-extension/CHANGELOG.md b/packages/chrome-extension/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Change Log
 
+## 3.1.65
+
+### Patch Changes
+
+- Updated dependencies [[`bf1b62a`](https://github.com/clerk/javascript/commit/bf1b62a552f005bc3258c4e48b6a205eeca5fed5), [`7f0cac8`](https://github.com/clerk/javascript/commit/7f0cac8d92496efda67fd434eb16bf2bd61e897e)]:
+  - @clerk/clerk-js@6.25.14
+
 ## 3.1.64
 
 ### Patch Changes

diff --git a/packages/chrome-extension/package.json b/packages/chrome-extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/chrome-extension",
-  "version": "3.1.64",
+  "version": "3.1.65",
   "description": "Clerk SDK for Chrome extensions",
   "keywords": [
     "auth",

diff --git a/packages/clerk-js/CHANGELOG.md b/packages/clerk-js/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Change Log
 
+## 6.25.14
+
+### Patch Changes
+
+- Recover from partitioned-cookie startup races by removing stale non-partitioned cookies when partitioned cookies become available. ([#9286](https://github.com/clerk/javascript/pull/9286)) by [@thiskevinwang](https://github.com/thiskevinwang)
+
+- Complete the Safari ITP cookie refresh when `setActive({ redirectUrl })` navigates. ([#9308](https://github.com/clerk/javascript/pull/9308)) by [@dmoerner](https://github.com/dmoerner)
+
+  Safari's ITP caps the client cookie at 7 days when it is re-issued from a fetch, so `setActive()` routes its redirect through `/v1/client/touch` to restore the full lifetime. That navigation was immediately followed by a second one to the undecorated redirect URL, which superseded it and aborted the touch request before it completed, leaving the cookie capped.
+
+  This applies to flows that pass `redirectUrl` without a `navigate` callback — email link sign-in, the password reset success screen, the OAuth popup flow, and direct `setActive({ session, redirectUrl })` calls — in apps where Clerk performs a full page navigation rather than handing off to a router. Users still landed on the correct page, so the only symptom was Safari sessions ending after 7 days and returning devices being challenged as if they were new.
+
 ## 6.25.13
 
 ### Patch Changes

diff --git a/packages/clerk-js/package.json b/packages/clerk-js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/clerk-js",
-  "version": "6.25.13",
+  "version": "6.25.14",
   "description": "Clerk JS library",
   "keywords": [
     "clerk",

diff --git a/packages/electron/CHANGELOG.md b/packages/electron/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @clerk/electron
 
+## 0.0.26
+
+### Patch Changes
+
+- Updated dependencies [[`bf1b62a`](https://github.com/clerk/javascript/commit/bf1b62a552f005bc3258c4e48b6a205eeca5fed5), [`7f0cac8`](https://github.com/clerk/javascript/commit/7f0cac8d92496efda67fd434eb16bf2bd61e897e)]:
+  - @clerk/clerk-js@6.25.14
+
 ## 0.0.25
 
 ### Patch Changes

diff --git a/packages/electron/package.json b/packages/electron/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/electron",
-  "version": "0.0.25",
+  "version": "0.0.26",
   "description": "Clerk SDK for Electron",
   "keywords": [
     "clerk",

diff --git a/packages/expo/CHANGELOG.md b/packages/expo/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Change Log
 
+## 4.2.1
+
+### Patch Changes
+
+- Updated dependencies [[`bf1b62a`](https://github.com/clerk/javascript/commit/bf1b62a552f005bc3258c4e48b6a205eeca5fed5), [`7f0cac8`](https://github.com/clerk/javascript/commit/7f0cac8d92496efda67fd434eb16bf2bd61e897e)]:
+  - @clerk/clerk-js@6.25.14
+
 ## 4.2.0
 
 ### Minor Changes

diff --git a/packages/expo/package.json b/packages/expo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/expo",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "Clerk React Native/Expo library",
   "keywords": [
     "react",

diff --git a/packages/express/CHANGELOG.md b/packages/express/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Change Log
 
+## 2.1.50
+
+### Patch Changes
+
+- Respond with 400 Bad Request instead of surfacing a 500 when an incoming request cannot be represented as a fetch `Request`. Vulnerability-scanner probes such as hostless `//` request targets, targets that parse as credentialed URLs, and forbidden methods like TRACE previously threw inside the middleware and polluted error logs. ([#9290](https://github.com/clerk/javascript/pull/9290)) by [@wobsoriano](https://github.com/wobsoriano)
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 2.1.49
 
 ### Patch Changes

diff --git a/packages/express/package.json b/packages/express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/express",
-  "version": "2.1.49",
+  "version": "2.1.50",
   "description": "Clerk server SDK for usage with Express",
   "keywords": [
     "clerk",

diff --git a/packages/fastify/CHANGELOG.md b/packages/fastify/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Change Log
 
+## 3.1.60
+
+### Patch Changes
+
+- Respond with 400 Bad Request instead of surfacing a 500 when an incoming request cannot be represented as a fetch `Request`. Vulnerability-scanner probes such as hostless `//` request targets, targets that parse as credentialed URLs, and forbidden methods like TRACE previously threw inside the middleware and polluted error logs. ([#9290](https://github.com/clerk/javascript/pull/9290)) by [@wobsoriano](https://github.com/wobsoriano)
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 3.1.59
 
 ### Patch Changes

diff --git a/packages/fastify/package.json b/packages/fastify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/fastify",
-  "version": "3.1.59",
+  "version": "3.1.60",
   "description": "Clerk SDK for Fastify",
   "keywords": [
     "auth",

diff --git a/packages/hono/CHANGELOG.md b/packages/hono/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @clerk/hono
 
+## 0.1.60
+
+### Patch Changes
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 0.1.59
 
 ### Patch Changes

diff --git a/packages/hono/package.json b/packages/hono/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/hono",
-  "version": "0.1.59",
+  "version": "0.1.60",
   "description": "Clerk SDK for Hono",
   "keywords": [
     "auth",

diff --git a/packages/nextjs/CHANGELOG.md b/packages/nextjs/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Change Log
 
+## 7.6.5
+
+### Patch Changes
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 7.6.4
 
 ### Patch Changes

diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/nextjs",
-  "version": "7.6.4",
+  "version": "7.6.5",
   "description": "Clerk SDK for NextJS",
   "keywords": [
     "clerk",

diff --git a/packages/nuxt/CHANGELOG.md b/packages/nuxt/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @clerk/nuxt
 
+## 3.0.2
+
+### Patch Changes
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 3.0.1
 
 ### Patch Changes

diff --git a/packages/nuxt/package.json b/packages/nuxt/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/nuxt",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Clerk SDK for Nuxt",
   "keywords": [
     "clerk",

diff --git a/packages/react-router/CHANGELOG.md b/packages/react-router/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Change Log
 
+## 3.6.4
+
+### Patch Changes
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 3.6.3
 
 ### Patch Changes

diff --git a/packages/react-router/package.json b/packages/react-router/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/react-router",
-  "version": "3.6.3",
+  "version": "3.6.4",
   "description": "Clerk SDK for React Router",
   "keywords": [
     "clerk",

diff --git a/packages/tanstack-react-start/CHANGELOG.md b/packages/tanstack-react-start/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @clerk/tanstack-react-start
 
+## 1.4.27
+
+### Patch Changes
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 1.4.26
 
 ### Patch Changes

diff --git a/packages/tanstack-react-start/package.json b/packages/tanstack-react-start/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/tanstack-react-start",
-  "version": "1.4.26",
+  "version": "1.4.27",
   "description": "Clerk SDK for TanStack React Start",
   "keywords": [
     "clerk",

diff --git a/packages/testing/CHANGELOG.md b/packages/testing/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @clerk/testing
 
+## 2.2.17
+
+### Patch Changes
+
+- Updated dependencies [[`a601cd7`](https://github.com/clerk/javascript/commit/a601cd7f45095fdbf8b0a23b01d9f559feeda347)]:
+  - @clerk/backend@3.15.1
+
 ## 2.2.16
 
 ### Patch Changes

diff --git a/packages/testing/package.json b/packages/testing/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/testing",
-  "version": "2.2.16",
+  "version": "2.2.17",
   "description": "Utilities to help you create E2E test suites for apps using Clerk",
   "keywords": [
     "auth",