Repository navigation
build(deps): update frontend packages - #66
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/frontend-packages
branch
24 times, most recently
from
October 12, 2026 02:00
48a61a3 to
09acb82
Compare
renovate
Bot
force-pushed
the
renovate/frontend-packages
branch
3 times, most recently
from
October 13, 2026 02:48
f5022ca to
3e2b546
Compare
renovate
Bot
force-pushed
the
renovate/frontend-packages
branch
8 times, most recently
from
October 15, 2026 05:37
6dd38d2 to
8cddf23
Compare
renovate
Bot
force-pushed
the
renovate/frontend-packages
branch
from
October 15, 2026 12:04
8cddf23 to
963d4db
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^6.34.1→^6.39.0^6.17.2→^6.17.8^4.36.0→^4.40.02.2.39→2.2.451.63.0→1.64.01.64.1^1.11.2→^1.11.3^1.3.3→^1.5.0^11.0.0→^11.7.011.8.0^5.4.0→^5.4.1^5.104.0→^5.104.25.104.3^5.104.0→^5.104.25.104.3^5.104.0→^5.104.25.104.3^1.170.40→^1.170.44^9.2.4→^9.3.1^3.14.13→^3.14.183.14.20(+1)^1.168.41→^1.168.451.168.46^26.6.3→^26.6.5^6.1.1→^6.1.25.0.1→5.0.45.0.55.0.1→5.0.45.0.5^13.4.4→^13.5.1^17.12.0→^17.13.0^11.1.18→^11.1.21^1.48.0→^1.56.01.57.0^26→^26.11.1v26.12.0^0.71.0→^0.73.0^1.86.0→^1.88.0^7.0.2003→^7.0.20041.63.0→1.64.01.64.1^12→^12.11.2^1.434.16→^1.438.91.438.11(+1)^1.6.7→^1.8.1^10.0.1→^10.0.2^7.89.0→^7.90.0^4.14.1→^4.14.5^21.1.0→^21.1.1^4.21.0→^4.21.44.21.51.0.0→1.1.01.2.01.0.0→1.1.01.2.05.0.1→5.0.45.0.5^4.6.5→^4.6.7Release Notes
clerk/javascript (@clerk/clerk-js)
v6.39.0Compare Source
Minor Changes
<OrganizationProfile />. Organization admins can now assign an organization role to each directory group their identity provider pushes, set which group wins when a member belongs to several, and turn role syncing on or off. Members in no mapped group keep the organization's default role. The step is read-only for members without theorg:sys_memberships:managepermission and while the organization's role set is being migrated. (#10081) by @kalafutPatch Changes
Add an
enterpriseConnectionsUrloption tohandleRedirectCallback()and<AuthenticateWithRedirectCallback />. When the Clerk API asks an OAuth sign-up to choose between several enterprise connections for the same email domain, the callback navigates to this URL, which defaults to theenterprise-connectionsroute of your sign-up page. (#9947) by @NicolasLopes7Updated dependencies [
dcb03d3,31c1930]:v6.38.1Compare Source
Patch Changes
Fix
<HandleSSOCallback />dropping the error when a Clerk Protect challenge fails on the SSO callback. The error is now available onerrorsfromuseSignIn()oruseSignUp(), and a failed sign-up challenge callsnavigateToSignUpinstead ofnavigateToSignIn. (#10103) by @wobsorianoUpdated dependencies [
568c668]:v6.38.0Compare Source
Minor Changes
EnterpriseConnection.samlConnectionnow includesidpCertificates, every trusted certificate with its validity window, andorganization.createEnterpriseConnection()andorganization.updateEnterpriseConnection()acceptsaml.idpCertificates, an array that replaces the connection's whole set. The singlesaml.idpCertificateinput is deprecated in favor of the array; it keeps working and still replaces the whole set. (#9996) by @mauricioabreuPatch Changes
2654caa]:v6.37.0Compare Source
Minor Changes
trusted_devicestrategy for sign-in and session reverification,nativeSettingson the auth config, and__experimental_methods onUserfor managing biometric credentials. These may change in minor releases. (#9989) by @mikepitrePatch Changes
f6937c8]:v6.36.0Compare Source
Minor Changes
useSignIn()anduseSignUp()now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to<HandleSSOCallback />. Classic resource methods such asclerk.client.signIn.create(), and apps without Clerk's UI loaded, still return withprotectCheckset, as before. (#9950) by @wobsorianoPatch Changes
The Solana wallet picker downloads about 2 KB instead of about 306 KB, and installing
@clerk/uior@clerk/clerk-jsno longer pulls in React Native, Metro, and@solana/web3.js. The picker now lists only wallets that can complete Sign in with Solana, so the Mobile Wallet Adapter option that appeared on Android Chrome is gone. (#9994) by @manovotnyUpdated dependencies [
c8eb8d5]:v6.35.0Compare Source
Minor Changes
DirectorySyncgainssetCredentials(),sync(),getSyncStatus(), andcredentialsConfigured. (#9722) by @gabrielmeloc22Patch Changes
Capture authentication timezones so Clerk emails can display timestamps in a stored user timezone. (#9540) by @tmilewski
Fix abandoned passkey registrations counting toward the limit on unverified identifications. Cancelling or failing the browser passkey prompt left a pending registration on the account that is hidden from the user's passkey list, so it could silently block adding an email address or phone number until it expired. The pending registration is now removed as soon as the prompt is abandoned. In
<UserProfile />, the "Add a passkey" button also shows a loading state while a registration is in progress, and a failed attempt no longer leaves its error banner on screen after a later attempt succeeds. (#9812) by @brunol95Ignore errors from the background session touch that runs when the page regains focus. (#9965) by @Ephem
These errors were previously both unhandled and uncaught, now they are just intentionally unhandled. The page is usually in a good enough state to recover gracefully, but the uncaught errors led to noise in the browser console and error tracking tools which we now avoid.
Updated dependencies [
6a14691,0ee4ee2,7a3fcf5,69c1b9c,d9cf0f2]:clerk/javascript (@clerk/react)
v6.17.8Compare Source
Patch Changes
dcb03d3,31c1930]:v6.17.7Compare Source
Patch Changes
Fix
<HandleSSOCallback />dropping the error when a Clerk Protect challenge fails on the SSO callback. The error is now available onerrorsfromuseSignIn()oruseSignUp(), and a failed sign-up challenge callsnavigateToSignUpinstead ofnavigateToSignIn. (#10103) by @wobsorianoUpdated dependencies [
568c668]:v6.17.6Compare Source
Patch Changes
2654caa]:v6.17.5Compare Source
Patch Changes
f6937c8]:v6.17.4Compare Source
Patch Changes
Custom flows built with
useSignIn()anduseSignUp()now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to<HandleSSOCallback />. Classic resource methods such asclerk.client.signIn.create(), and apps without Clerk's UI loaded, still return withprotectCheckset, as before. (#9950) by @wobsorianoUpdated dependencies [
c8eb8d5]:v6.17.3Compare Source
Patch Changes
Capture authentication timezones so Clerk emails can display timestamps in a stored user timezone. (#9540) by @tmilewski
Updated dependencies [
6a14691,0ee4ee2,7a3fcf5,69c1b9c,d9cf0f2]:clerk/javascript (@clerk/shared)
v4.40.0Compare Source
Minor Changes
<OrganizationProfile />. Organization admins can now assign an organization role to each directory group their identity provider pushes, set which group wins when a member belongs to several, and turn role syncing on or off. Members in no mapped group keep the organization's default role. The step is read-only for members without theorg:sys_memberships:managepermission and while the organization's role set is being migrated. (#10081) by @kalafutPatch Changes
enterpriseConnectionsUrloption tohandleRedirectCallback()and<AuthenticateWithRedirectCallback />. When the Clerk API asks an OAuth sign-up to choose between several enterprise connections for the same email domain, the callback navigates to this URL, which defaults to theenterprise-connectionsroute of your sign-up page. (#9947) by @NicolasLopes7v4.39.1Compare Source
Patch Changes
npx clerk@latest initdoes not need a Clerk account and writes temporary dev keys. Readers previously sawinitlisted besidelink,env pulland the Dashboard link, and assumed signing up was required before any of the steps would work. (#10099) by @eatmorespinachv4.39.0Compare Source
Minor Changes
EnterpriseConnection.samlConnectionnow includesidpCertificates, every trusted certificate with its validity window, andorganization.createEnterpriseConnection()andorganization.updateEnterpriseConnection()acceptsaml.idpCertificates, an array that replaces the connection's whole set. The singlesaml.idpCertificateinput is deprecated in favor of the array; it keeps working and still replaces the whole set. (#9996) by @mauricioabreuv4.38.0Compare Source
Minor Changes
trusted_devicestrategy for sign-in and session reverification,nativeSettingson the auth config, and__experimental_methods onUserfor managing biometric credentials. These may change in minor releases. (#9989) by @mikepitrev4.37.1Compare Source
Patch Changes
useSignIn()anduseSignUp()now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to<HandleSSOCallback />. Classic resource methods such asclerk.client.signIn.create(), and apps without Clerk's UI loaded, still return withprotectCheckset, as before. (#9950) by @wobsorianov4.37.0Compare Source
Minor Changes
Support Google Workspace directories in Directory Sync. Organization admins can upload a service account key and delegated admin email from the setup flow, start a sync on demand, and see the result of the last one.
DirectorySyncgainssetCredentials(),sync(),getSyncStatus(), andcredentialsConfigured. (#9722) by @gabrielmeloc22Update the SSO and Directory Sync sections of the
<OrganizationProfile />Security page to the latest designs. Both sections now show a "Configure" button until something is set up (SSO then shows "Add connection"), and SSO connection rows show the identity provider's logo and an actions menu (Edit, Continue configuration, Activate/Deactivate, Remove). These actions have been removed from the SSO connection page, and status badges are no longer color-coded. Okta logos now follow the theme's foreground color, so they stay visible in dark mode, including on the enterprise connection chooser and in<UserProfile />. (#9940) by @kalafutThe SSO button uses the new
ssoSection.primaryButton__configurelocalization key;ssoSection.primaryButton__startConfigurationis deprecated and no longer used. IndirectorySyncSection,primaryButton__startConfigurationis renamed toprimaryButton__configureandbadge__unconfiguredis removed.Patch Changes
Capture authentication timezones so Clerk emails can display timestamps in a stored user timezone. (#9540) by @tmilewski
Fix publishable-key generation for production instances in local Clerk environments. (#9633) by @brkalow
Add a localized message for the
too_many_unverified_identificationserror, shown when adding an email address or phone number is blocked by pending verifications or an incomplete passkey setup. (#9812) by @brunol95clerk/javascript (@clerk/testing)
v2.2.45Compare Source
Patch Changes
dcb03d3,31c1930]:v2.2.44Compare Source
Patch Changes
568c668]:v2.2.43Compare Source
Patch Changes
2302140,2654caa,dee649c]:v2.2.42Compare Source
Patch Changes
4eac21f,f6937c8]:v2.2.41Compare Source
Patch Changes
0fe89c2,e34a5cc,c8eb8d5]:v2.2.40Compare Source
Patch Changes
397fd72,6a14691,0ee4ee2,7a3fcf5,69c1b9c,d9cf0f2,f8266be]:microsoft/playwright (@playwright/test)
v1.64.0Compare Source
🧰 WebMCP
New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:
Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as
webmcp_<tool>. Pass--no-webmcpto opt out.playwright-cliexposes them as well:playwright-cli webmcp-list playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'🎬 Better videos
Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:
fpsoption in testOptions.video,recordVideoandscreencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
styleoption takes CSS declarations for thepointmarker, the targethighlightand the actiontitle. It replaces thefontSizeoption, which is now deprecated.quality.
playwright-cli.🎯 Test runner
New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain
npx playwright testrun just your favourite one:New
--shufflecommand line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.New
lockoption in test.describe.configure() adds test locks to all tests in a file or a group:New
typeoption oftoHaveScreenshotin testConfig.expect stores all unnamed screenshots as WebP:🪆 Locator.within()
New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":
Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:
New APIs
New page.getByRef() locates an element by its aria ref, such as
e2, reported by page.ariaSnapshot() in the'ai'mode.New option
includeShadowin page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.New option
signCountsets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the currentsignCount, and it is saved and restored together with the credentials in the storage state.New fullConfig.filteredProjects lists the projects that were selected to run after applying the
--projectfilter. It is available in global setup and reporters.New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:
Breaking changes⚠️
screenproperty is now forwarded from the device descriptors. If you use...devices['Desktop Chrome']and alike,window.screenand media queries now see the emulated screen size. You can opt-out by explicitly settingscreentoundefined:JSX in your test files now follows your
tsconfig.json. Playwright compiles JSX in test files according to thejsx,jsxFactory,jsxFragmentFactoryandjsxImportSourcetsconfig options, and defaults to the automatic runtime fromreact/jsx-runtime.--update-snapshots=missingnow passes the test run. Tests that only create missing snapshots now pass in the'missing'mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called'default'and behaves as before: missing snapshots are written and the test fails.Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with
visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().Browser Versions
This version was also tested against the following stable channels:
PostHog/posthog-js (@posthog/react)
v1.11.3Compare Source
Patch Changes
5929eabThanks @breken-ai! - PostHogFeature withoutmatchshows the fallback when the flag evaluates to false.(2026-09-29)
5929eab]:radix-ui/primitives (@radix-ui/react-slot)
v1.5.0undefinedfor all optional types for compatibility with TypeScript'sexactOptionalPropertyTypesflag.Slotthrowing when anasChildchild is a lazy reference whose resolved value is itself a lazy reference.v1.4.0aria-describedbyattributes.getsentry/sentry-javascript (@sentry/react)
v11.7.0Compare Source
Important Changes
feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)
The new
cronTriggersIntegrationsends check-ins for Cron Triggers. Each check-in includes the schedule fromcontroller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare V
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.