[dependabot]

Bumps @clerk/backend from 3.22.0 to 3.26.5.

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.26.5

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @​dominic-clerk

• Add bcrypt_peppered, md5_salted, pbkdf2_sha512, pbkdf2_sha512_hex, sha256_salted, and sha512_symfony to the PasswordHasher type, so TypeScript accepts every hasher the createUser() JSDoc documents. The JSDoc for md5_salted and sha256_salted now also shows the password_digest format the Backend API accepts: hash$salt, not salt$hash. (#10504) by @​manovotny

• Updated dependencies [debfc72]:

  • @​clerk/shared@​4.43.1

@​clerk/backend@​3.26.4

Patch Changes

• Updated dependencies [4ce996f]:
  • @​clerk/shared@​4.43.0

@​clerk/backend@​3.26.3

Patch Changes

• Update the lockUser() JSDoc to link to the Protections page under Protect (/~/protect/protections) in the Clerk Dashboard. Point the user lock links in the lockUser(), unlockUser(), CreateUserParams.locked, and User.locked JSDoc to the current guide on user locks. (#10395) by @​mwickett

• Session expireAt and abandonAt no longer special-case a 0 deadline; the backend now always sends a real deadline. (#10389) by @​swolfand

• Updated dependencies [0a6e367, cf9c897]:

  • @​clerk/shared@​4.42.0

@​clerk/backend@​3.26.1

Patch Changes

• Stop accepting the legacy cl_I7d4PD111III JWT category as a session or handshake token. Clerk no longer issues it, so authenticateRequest() now returns a signed-out state with reason token-type-mismatch for a token carrying it, the same as for other non-session categories. (#10286) by @​dominic-clerk

Changelog

Sourced from @​clerk/backend's changelog.

3.26.5

Patch Changes

• tslib is no longer installed as a runtime dependency. The published builds never imported it. (#10521) by @​dominic-clerk

• Add bcrypt_peppered, md5_salted, pbkdf2_sha512, pbkdf2_sha512_hex, sha256_salted, and sha512_symfony to the PasswordHasher type, so TypeScript accepts every hasher the createUser() JSDoc documents. The JSDoc for md5_salted and sha256_salted now also shows the password_digest format the Backend API accepts: hash$salt, not salt$hash. (#10504) by @​manovotny

• Updated dependencies [debfc72]:

  • @​clerk/shared@​4.43.1

3.26.4

Patch Changes

• Updated dependencies [4ce996f]:
  • @​clerk/shared@​4.43.0

3.26.3

Patch Changes

• Update the lockUser() JSDoc to link to the Protections page under Protect (/~/protect/protections) in the Clerk Dashboard. Point the user lock links in the lockUser(), unlockUser(), CreateUserParams.locked, and User.locked JSDoc to the current guide on user locks. (#10395) by @​mwickett

• Session expireAt and abandonAt no longer special-case a 0 deadline; the backend now always sends a real deadline. (#10389) by @​swolfand

• Updated dependencies [0a6e367, cf9c897]:

  • @​clerk/shared@​4.42.0

3.26.2

Patch Changes

• Updated dependencies [8c3739d, 0334b05]:
  • @​clerk/shared@​4.41.1

3.26.1

Patch Changes

• Stop accepting the legacy cl_I7d4PD111III JWT category as a session or handshake token. Clerk no longer issues it, so authenticateRequest() now returns a signed-out state with reason token-type-mismatch for a token carrying it, the same as for other non-session categories. (#10286) by @​dominic-clerk

3.26.0

Minor Changes

• Add webhook types for transactional email delivery, delays, bounces, complaints, failures, and suppressions. Bounce events distinguish Permanent, Transient, and Undetermined classifications. verifyWebhook() preserves the original event timestamp and instance ID for outcome handlers. These types prepare for the transactional email pilot; receiving the events requires the corresponding backend rollout. (#9776) by @​jescalan

Patch Changes

... (truncated)

Commits

• 97140a8 ci(repo): Version packages (#10475)
• 11907aa fix(backend): correct salted password digests and accept every documented has...
• cd21ebe chore(repo): Move tslib to devDependencies (#10521)
• 8098bb9 chore(repo): Consolidate overlapping dev dependencies (#10485)
• 870b9a7 ci(repo): Version packages (#10464)
• 3fa3ad1 ci(repo): Version packages (#10393)
• d005fee fix(backend): point lockUser() JSDoc to the Protections Dashboard page (#10395)
• 0a6e367 revert(clerk-js,shared): remove zero session deadline handling (#10389)
• 8b9403b ci(repo): Version packages (#10347)
• 0334b05 fix(clerk-js): preserve indefinite session deadlines (#9871)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dashboard-skillcheck	Ready	Preview	Nov 3, 2026 4:44pm UTC

[dependabot]

Superseded by #127.