JavaScript SDK

fix(clerk-js): Prevent background token refresh from destroying sessions on mobile (#8303) by @chriscanin

On iOS, background thread throttling can starve the JS event loop for hours (e.g., overnight audio apps). When the SDK's background refresh timer eventually fires with stale credentials, the resulting 401 would trigger handleUnauthenticated() and destroy the session even though it's still valid on the server.

Adds an early return in #refreshTokenInBackground(), gated to headless/mobile runtimes only (Expo sets runtimeEnvironment to 'headless'). If the token has already expired when the refresh timer fires, bail out instead of sending a request with stale credentials. The next foreground getToken() call handles token acquisition through the normal path with proper retry logic.

• @clerk/clerk-js@6.7.4
• @clerk/react@6.4.2

• @clerk/backend@3.2.13
• @clerk/react@6.4.2

• @clerk/ui@1.6.3
• @clerk/clerk-js@6.7.4
• @clerk/react@6.4.2

• @clerk/backend@3.2.13

• @clerk/backend@3.2.13

• @clerk/backend@3.2.13

• @clerk/backend@3.2.13

• @clerk/backend@3.2.13
• @clerk/react@6.4.2

• @clerk/backend@3.2.13
• @clerk/react@6.4.2

Fixed attrs type in custom UI components. (#8301) by @renovate

Updated dependencies [fcc6c0c]:

• @clerk/backend@3.2.13
• @clerk/vue@2.0.15

Fix EnableOrganizationsPrompt in keyless mode: show "Claim your application" CTA instead of broken "Sign in to continue" when organizations are enabled on an unclaimed keyless app with no signed-in user. (#8341) by @mwickett

Use user.organizationMemberships from the already-loaded user object to populate the org select in the OAuth consent screen, avoiding a redundant memberships fetch. (#8350) by @wobsoriano

Correctly display IP redirect URIs in OAuth consent. (#8342) by @wobsoriano

Add scroll-driven fade overlays to ListGroupContent in the OAuthConsent component so overflowing scope lists visually indicate more content above and below. (#8339) by @alexcarpenter

• @clerk/backend@3.2.13

• @clerk/backend@3.2.12
• @clerk/shared@4.8.2

Add infinite loading to organization selection in <OAuthConsent />. (#8309) by @wobsoriano

Fix OAuthConsent always redirecting to sign-in by adopting the AuthenticatedRoutes pattern used by other full-page components (#8327) by @alexcarpenter

Updated dependencies [c7b0f47, 34762e8]:

• @clerk/shared@4.8.2
• @clerk/localizations@4.5.2

• @clerk/backend@3.2.12
• @clerk/shared@4.8.2
• @clerk/react@6.4.2

Introduce samlConnection and oauthConfig into the EnterpriseConnection resource. (#8326) by @LauraBeatris

The JWT claims are verified after the signature to avoid leaking information through error messages on forged tokens. (#8332) by @dominic-clerk

Updated dependencies [c7b0f47, 34762e8]:

• @clerk/shared@4.8.2

• @clerk/backend@3.2.12
• @clerk/shared@4.8.2
• @clerk/vue@2.0.15

• @clerk/backend@3.2.12
• @clerk/shared@4.8.2
• @clerk/react@6.4.2