---
category: security
category_name: Security
release_count: 20
has_more: true
canonical: https://releases.sh/categories/security
---

<Release version="@clerk/expo@3.6.2" date="June 25, 2026" published="2026-06-25T22:03:18.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/expo%403.6.2" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Bump the bundled `clerk-ios` SDK from `1.2.5` to `1.2.6`. See the Clerk iOS release: <https://github.com/clerk/clerk-ios/releases/tag/1.2.6>. ([#9007](https://github.com/clerk/javascript/pull/9007)) by [@clerk-cookie](https://github.com/clerk-cookie)

</Release>

<Release version="1.2.6" date="June 25, 2026" published="2026-06-25T21:46:01.000Z" url="https://github.com/clerk/clerk-ios/releases/tag/1.2.6" org="clerk" source="clerk-ios-sdk">
## What's Changed
* Fix Expo iOS bump workflow by @mikepitre in https://github.com/clerk/clerk-ios/pull/483
* Update Expo release Slack notification by @mikepitre in https://github.com/clerk/clerk-ios/pull/485
* Gate Apple sign-in transfer by sign-up mode by @seanperez29 in https://github.com/clerk/clerk-ios/pull/487
* Render development mode indicator natively by @prestonwebdev in https://github.com/clerk/clerk-ios/pull/484

## New Contributors
* @prestonwebdev made their first contribution in https://github.com/clerk/clerk-ios/pull/484

**Full Changelog**: https://github.com/clerk/clerk-ios/compare/1.2.5...1.2.6
</Release>

<Release version="@clerk/testing@2.1.7" date="June 25, 2026" published="2026-06-25T18:24:38.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/testing%402.1.7" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/astro@3.4.8" date="June 25, 2026" published="2026-06-25T18:24:35.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/astro%403.4.8" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Fix custom user button menu item rendering for Astro's stricter compiler. ([#8980](https://github.com/clerk/javascript/pull/8980)) by [@wobsoriano](https://github.com/wobsoriano)

-   Deprecate `createRouteMatcher()` in favor of resource-based auth checks. ([#8981](https://github.com/clerk/javascript/pull/8981)) by [@wobsoriano](https://github.com/wobsoriano)

    Instead of protecting routes only from middleware, move auth checks into each protected Astro page, API route, or server-side handler:

    ```ts
    import type { APIRoute } from 'astro';

    export const GET: APIRoute = ({ locals }) => {
      const { userId } = locals.auth();

      if (!userId) {
        return new Response('Unauthorized', { status: 401 });
      }

      return Response.json({ userId });
    };
    ```

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/chrome-extension@3.1.44" date="June 25, 2026" published="2026-06-25T18:24:32.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/chrome-extension%403.1.44" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`afe9a90`](https://github.com/clerk/javascript/commit/afe9a90c5bee0e22a8b36040ec63690b6629ba22), [`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8), [`2492043`](https://github.com/clerk/javascript/commit/24920437b0c61c4852be830d5495e53ae956e37d), [`0691d46`](https://github.com/clerk/javascript/commit/0691d468e474672aa962c867789f06a3b71ba33a), [`a1e37f4`](https://github.com/clerk/javascript/commit/a1e37f466908ab5da94462ad1ebbaeb2549c00e5)]:
    -   @clerk/ui@1.23.0
    -   @clerk/clerk-js@6.22.0
    -   @clerk/shared@4.22.0
    -   @clerk/react@6.11.1

</Release>

<Release version="@clerk/clerk-js@6.22.0" date="June 25, 2026" published="2026-06-25T18:24:29.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.22.0" org="clerk" source="clerk-javascript-sdk">
### Minor Changes

-   Handle expired organization domains on self-serve SSO flow, allowing to trigger a new verification ([#9000](https://github.com/clerk/javascript/pull/9000)) by [@LauraBeatris](https://github.com/LauraBeatris)

### Patch Changes

-   Prevent a cross-tab broadcast failure from evicting a freshly cached session token. Previously, if broadcasting a token update to other tabs threw (for example when the `BroadcastChannel` was racing a close), the token that was just cached got dropped and the next `getToken()` made an unnecessary network request. The broadcast is now isolated so a failure no longer discards a valid cached token. ([#8969](https://github.com/clerk/javascript/pull/8969)) by [@jacekradko](https://github.com/jacekradko)

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0

</Release>

<Release version="@clerk/backend@3.8.4" date="June 25, 2026" published="2026-06-25T18:24:26.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.8.4" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0

</Release>

<Release version="@clerk/react@6.11.1" date="June 25, 2026" published="2026-06-25T18:24:23.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/react%406.11.1" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0

</Release>

<Release version="@clerk/fastify@3.1.42" date="June 25, 2026" published="2026-06-25T18:24:20.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/fastify%403.1.42" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/nuxt@2.6.8" date="June 25, 2026" published="2026-06-25T18:24:17.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/nuxt%402.6.8" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/vue@2.4.8
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/nextjs@7.5.9" date="June 25, 2026" published="2026-06-25T18:24:14.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.5.9" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/react@6.11.1
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/express@2.1.32" date="June 25, 2026" published="2026-06-25T18:24:11.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/express%402.1.32" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/shared@4.22.0" date="June 25, 2026" published="2026-06-25T18:24:08.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.22.0" org="clerk" source="clerk-javascript-sdk">
### Minor Changes

-   Handle expired organization domains on self-serve SSO flow, allowing to trigger a new verification ([#9000](https://github.com/clerk/javascript/pull/9000)) by [@LauraBeatris](https://github.com/LauraBeatris)

</Release>

<Release version="@clerk/localizations@4.11.0" date="June 25, 2026" published="2026-06-25T18:24:05.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/localizations%404.11.0" org="clerk" source="clerk-javascript-sdk">
### Minor Changes

-   Handle expired organization domains on self-serve SSO flow, allowing to trigger a new verification ([#9000](https://github.com/clerk/javascript/pull/9000)) by [@LauraBeatris](https://github.com/LauraBeatris)

### Patch Changes

-   Fix Okta instructions in self-serve SSO flow such as updating the expressions on attribute statement step ([#9001](https://github.com/clerk/javascript/pull/9001)) by [@SarahSoutoul](https://github.com/SarahSoutoul)

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0

</Release>

<Release version="@clerk/expo-passkeys@1.1.10" date="June 25, 2026" published="2026-06-25T18:24:02.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/expo-passkeys%401.1.10" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0

</Release>

<Release version="@clerk/electron@0.0.5" date="June 25, 2026" published="2026-06-25T18:23:59.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/electron%400.0.5" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8), [`2492043`](https://github.com/clerk/javascript/commit/24920437b0c61c4852be830d5495e53ae956e37d)]:
    -   @clerk/clerk-js@6.22.0
    -   @clerk/shared@4.22.0
    -   @clerk/react@6.11.1

</Release>

<Release version="@clerk/tanstack-react-start@1.4.9" date="June 25, 2026" published="2026-06-25T18:23:56.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/tanstack-react-start%401.4.9" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/react@6.11.1
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/react-router@3.5.1" date="June 25, 2026" published="2026-06-25T18:23:53.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.5.1" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/react@6.11.1
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/hono@0.1.42" date="June 25, 2026" published="2026-06-25T18:23:50.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/hono%400.1.42" org="clerk" source="clerk-javascript-sdk">
### Patch Changes

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8)]:
    -   @clerk/shared@4.22.0
    -   @clerk/backend@3.8.4

</Release>

<Release version="@clerk/ui@1.23.0" date="June 25, 2026" published="2026-06-25T18:23:47.000Z" url="https://github.com/clerk/javascript/releases/tag/%40clerk/ui%401.23.0" org="clerk" source="clerk-javascript-sdk">
### Minor Changes

-   Handle expired organization domains on self-serve SSO flow, allowing to trigger a new verification ([#9000](https://github.com/clerk/javascript/pull/9000)) by [@LauraBeatris](https://github.com/LauraBeatris)

-   Add drag-to-upload support in AvatarUploader ([#8348](https://github.com/clerk/javascript/pull/8348)) by [@alexcarpenter](https://github.com/alexcarpenter)

### Patch Changes

-   Fix the self-serve SSO configuration wizard losing your place when organization data refetches mid-flow. After submitting a Configure step (for example saving an identity provider's metadata), a background refetch on the OrganizationProfile Security page could unmount the open ConfigureSSO wizard and re-render it on an earlier step. The wizard now stays on its current step while data loads in the background. ([#8999](https://github.com/clerk/javascript/pull/8999)) by [@iagodahlem](https://github.com/iagodahlem)

-   Fix focus ring visibility on `Tab` elements for keyboard navigation. ([#8998](https://github.com/clerk/javascript/pull/8998)) by [@alexcarpenter](https://github.com/alexcarpenter)

-   Updated dependencies \[[`19ce04a`](https://github.com/clerk/javascript/commit/19ce04aab6387c430dc41e51c6130a88cc543cc8), [`3e036f4`](https://github.com/clerk/javascript/commit/3e036f425da47d781a45a0805ec8b0fcc6f38eff)]:
    -   @clerk/localizations@4.11.0
    -   @clerk/shared@4.22.0

</Release>

<Pagination cursor="2026-06-25T18:23:47.000Z|2026-06-25T19:04:07.368Z|rel_TTGfsUBHeqQpLFWHZuWxn" next="https://releases.sh/categories/security/releases?cursor=2026-06-25T18%3A23%3A47.000Z%7C2026-06-25T19%3A04%3A07.368Z%7Crel_TTGfsUBHeqQpLFWHZuWxn&limit=20" />