{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_ILgTISV69bVwu2HzcrRP4","weekStart":"2026-09-28","title":"Auth SDKs ship a security-heavy week of account-takeover fixes and enterprise SSO controls","intro":"Better Auth patched a critical Magic Link account-takeover vulnerability, Clerk made Directory Sync self-serve for organization admins and added an SSO bypass for locked-out enterprise users, while Auth0 warned that refresh tokens are about to get longer and Clerk's JavaScript SDK rolled a Protect-challenge overhaul out across every framework package.","body":"### A critical fix lands in Better Auth\n\nThe week's most urgent item is [Better Auth's patch for a Magic Link account-takeover vulnerability](/release/rel_pCPmE8VG7SQmox0trpcN7-better-auth-v1-7-7-patches-critical-magic-link-account-takeover-vulnerability), which also covered an OAuth Proxy bug that accepted sign-in state as a provider profile. Anyone running Magic Link on shared verification storage needs to upgrade every server in the group together, request fresh Magic Links, and restart any OAuth or SAML sign-ins that were mid-flight — no database migration required, but the sequencing matters because a half-upgraded fleet is exactly the window an attacker wants. The same release tightened a handful of adjacent loose ends: ID-token sign-ins now respect the social provider's `disableSignUp` setting, concurrent PostgreSQL requests no longer slip past database-backed rate limits, and CAPTCHA and rate-limit errors finally carry proper JSON Content-Type headers.\n\n### Enterprise SSO gets more self-serve, and a pressure valve\n\nClerk spent the week making enterprise connections less dependent on support tickets. [Self-serve Directory Sync](/release/rel_0aTLwrBruaJl5Eyh3XwEf-clerk-launches-self-serve-directory-sync-for-organization-admins) lets a customer's own IT admins configure SCIM provisioning — including Google Workspace via the Google Admin SDK — from the Security tab inside `<OrganizationProfile />`, rather than waiting on a customer team to hand over a SCIM endpoint and bearer token. It's gated behind Organizations plus the Pro or Business plan with the B2B Authentication add-on, and stays off until you enable it under Organization permissions.\n\nThe counterpart is [SSO bypass](/release/rel_x7nhTOb29mumKa7CA1rG0-clerk-adds-sso-bypass-so-allowlisted-users-can-sign-in-by-email-code), which addresses the failure mode every enterprise deployment eventually hits: the IdP goes down or a certificate expires, and the very people who could fix it can't sign in. Allowlisted users can now fall back to a one-time email code through a \"Can't use SSO?\" link in the `SignIn` component, everyone else stays pinned to SSO, and each successful bypass is recorded as a `sign_in.sso_bypass.succeeded` event in Application Logs — so the escape hatch is auditable rather than invisible. The allowlist itself is manageable from the Dashboard, the Backend API, or by org members holding the `org:sys_entconns_sso_bypass:manage` permission.\n\n### Clerk's JavaScript SDK ships a broad release train\n\nClerk's JavaScript SDK cut a long series of coordinated packages, and the headline change is that [custom flows built with `useSignIn()` and `useSignUp()` now handle Clerk Protect challenges automatically](/release/rel_bC5YageFWXiT6RlZ0o6uJ-clerk-clerk-js-6-36-0-handles-clerk-protect-challenges-in-custom-flows) — the challenge surfaces in a modal and the method returns once the user passes it, with SSO challenges appearing back at `<HandleSSOCallback />`. That behavior propagated outward to [Clerk UI](/release/rel_Z_E0pQ4EuUowvM4wS2M6d-clerk-ui-v1-38-0-handles-protect-challenges-in-custom-sign-in-and-sign-up-flows), [React](/release/rel_43wMT4UcIYGWtjsVADo1G-clerk-react-6-17-4-handles-clerk-protect-challenges-in-custom-flows), [shared](/release/rel_OL7q0XNmXE4iFl8TuSCLa-clerk-shared-4-37-1-handles-clerk-protect-challenges-in-custom-flows), the [Electron](/release/rel_LNeBL7dmHGWe7reggYbfV-clerk-javascript-sdk-clerk-electron-0-0-49-dependency-update) and [Chrome extension](/release/rel_jQthEs2x8kjjkUTmD5JGZ-clerk-javascript-sdk-clerk-chrome-extension-3-1-89-dependency-update) wrappers, plus the usual dependents. The same work shrank the Solana wallet picker from 306 KB to 2 KB, dropping React Native, Metro, and `@solana/web3.js` from the bundle.\n\nElsewhere in the train: [Mosaic fixed menu popups animating closed and mouse-triggered focus rings](/release/rel_r6AyCy6cJlPUjhe8UqDOB-clerk-mosaic-v0-1-4-fixes-menu-animation-and-focus-ring-display), [Next.js stopped ending error messages with a period](/release/rel_DSybudV42c5WQwPrUkcuP-clerk-nextjs-v7-9-9-removes-period-from-error-messages-to-fix-broken-urls) because agents were fetching the trailing dot and 404ing, [the backend JSDoc clarified Electron dev-server origins and linked the Protect rules page](/release/rel_qNKzVQFJ_sN5wEriLqd37-clerk-javascript-sdk-v3-21-1-clarifies-electron-and-protect-documentation), and [Expo bumped its bundled Android SDK](/release/rel_GYb1SrochlqfQt9VR_EtE-clerk-expo-sdk-v4-7-3-bumps-bundled-android-sdk-to-1-1-10). The rest of the wave — [Fastify](/release/rel_CA2qKaupGX_IVqWXLl_kE-clerk-javascript-sdk-clerk-fastify-3-1-84-dependency-update), [Express](/release/rel_AJYH8fecwzV3aYMnF-as--clerk-express-v2-1-74-dependency-update), [Nuxt](/release/rel_ZUkiBqSSIUylKVna3QJF3-clerk-javascript-sdk-clerk-nuxt-3-1-8-dependency-update), [Hono](/release/rel__cBAj24wNY63CY15pzAPB-clerk-javascript-sdk-clerk-hono-0-1-84-dependency-update), [Vue](/release/rel_L9pIcpOh0Fl8gL57lnGrM-clerk-vue-v2-5-8-dependency-update), [testing](/release/rel_jIkDoj6pGnNOptqcjpKc8-clerk-testing-v2-2-41-dependency-update), [React Router](/release/rel_aIcbDW7CvvlnZ4zP-lvRa-clerk-javascript-sdk-clerk-react-router-3-6-29-dependency-update), [TanStack Start](/release/rel_tbbIzCNLM6WBxo5W2CvhI-clerk-javascript-sdk-clerk-tanstack-react-start-1-6-3-dependency-update), [Astro](/release/rel_IAEY5lskkP638KcqVl5No-clerk-javascript-sdk-clerk-astro-4-1-8-dependency-update), [Expo Passkeys](/release/rel_6JR7DfKgGcNOBc_i652sz-clerk-expo-passkeys-2-0-25-dependency-update), and [localizations](/release/rel_lQWeZUJDRpZHwcF8yu4Sh-clerk-localizations-4-21-1-dependency-update) — was routine dependency churn.\n\n### Breaking changes to plan for\n\nTwo smaller releases carry upgrade work. The [Clerk iOS SDK simplified its Billing `has()` method and read API call shapes](/release/rel_Su6lKLr0AAMbQ9E9qmK_y-clerk-ios-sdk-1-5-8-breaks-billing-has-and-read-api-call-shapes) — a breaking change for existing callers — while also fixing refreshed tokens drifting out of sync with session state, non-idempotent requests being retried after a possible server-side effect, and a telemetry flush loop that kept the collector alive. And [Auth0 is raising refresh token entropy](/release/rel_blp6R1niqAaweatyBMc5y-auth0-to-lengthen-refresh-tokens-beyond-45-characters), which means newly issued tokens will exceed the current ~45-character baseline. Existing sessions stay valid, but hardcoded length checks, fixed-width columns like `VARCHAR(45)`, and maximum-length regexes will start failing — worth a grep before the change lands.","releaseIds":["rel_pCPmE8VG7SQmox0trpcN7","rel_0aTLwrBruaJl5Eyh3XwEf","rel_x7nhTOb29mumKa7CA1rG0","rel_bC5YageFWXiT6RlZ0o6uJ","rel_Z_E0pQ4EuUowvM4wS2M6d","rel_43wMT4UcIYGWtjsVADo1G","rel_OL7q0XNmXE4iFl8TuSCLa","rel_LNeBL7dmHGWe7reggYbfV","rel_jQthEs2x8kjjkUTmD5JGZ","rel_r6AyCy6cJlPUjhe8UqDOB","rel_DSybudV42c5WQwPrUkcuP","rel_qNKzVQFJ_sN5wEriLqd37","rel_GYb1SrochlqfQt9VR_EtE","rel_CA2qKaupGX_IVqWXLl_kE","rel_AJYH8fecwzV3aYMnF-as-","rel_ZUkiBqSSIUylKVna3QJF3","rel__cBAj24wNY63CY15pzAPB","rel_L9pIcpOh0Fl8gL57lnGrM","rel_jIkDoj6pGnNOptqcjpKc8","rel_aIcbDW7CvvlnZ4zP-lvRa","rel_tbbIzCNLM6WBxo5W2CvhI","rel_IAEY5lskkP638KcqVl5No","rel_6JR7DfKgGcNOBc_i652sz","rel_lQWeZUJDRpZHwcF8yu4Sh","rel_Su6lKLr0AAMbQ9E9qmK_y","rel_blp6R1niqAaweatyBMc5y"],"releaseCount":26,"generatedAt":"2026-10-05T06:19:04.376Z","releases":[{"id":"rel_pCPmE8VG7SQmox0trpcN7","title":"better-auth v1.7.7 patches critical Magic Link account-takeover vulnerability","path":"/release/rel_pCPmE8VG7SQmox0trpcN7-critical-magic-link-takeover-patched-oauth-proxy-state-fix","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.7","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":4},{"id":"rel_0aTLwrBruaJl5Eyh3XwEf","title":"Clerk launches self-serve Directory Sync for Organization admins","path":"/release/rel_0aTLwrBruaJl5Eyh3XwEf-directory-sync-now-self-serve-in-organizationprofile","url":"https://clerk.com/changelog/2026-09-30-self-serve-directory-sync","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":4},{"id":"rel_x7nhTOb29mumKa7CA1rG0","title":"Clerk adds SSO bypass so allowlisted users can sign in by email code","path":"/release/rel_x7nhTOb29mumKa7CA1rG0-sso-bypass-allowlisted-users-sign-in-via-email-code","url":"https://clerk.com/changelog/2026-09-29-sso-bypass","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_bC5YageFWXiT6RlZ0o6uJ","title":"@clerk/clerk-js@6.36.0 handles Clerk Protect challenges in custom flows","path":"/release/rel_bC5YageFWXiT6RlZ0o6uJ-custom-sign-in-sign-up-flows-handle-clerk-protect-challenges-automatically","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.36.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_Z_E0pQ4EuUowvM4wS2M6d","title":"Clerk UI v1.38.0 handles Protect challenges in custom sign-in and sign-up flows","path":"/release/rel_Z_E0pQ4EuUowvM4wS2M6d-custom-flows-auto-handle-clerk-protect-challenges","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/ui%401.38.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_43wMT4UcIYGWtjsVADo1G","title":"@clerk/react@6.17.4 handles Clerk Protect challenges in custom flows","path":"/release/rel_43wMT4UcIYGWtjsVADo1G-usesignin-usesignup-now-handle-protect-challenges-automatically","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/react%406.17.4","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_OL7q0XNmXE4iFl8TuSCLa","title":"@clerk/shared@4.37.1 handles Clerk Protect challenges in custom flows","path":"/release/rel_OL7q0XNmXE4iFl8TuSCLa-usesignin-and-usesignup-now-handle-protect-challenges-automatically","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.37.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_LNeBL7dmHGWe7reggYbfV","title":"Clerk JavaScript SDK @clerk/electron@0.0.49 dependency update","path":"/release/rel_LNeBL7dmHGWe7reggYbfV-clerk-javascript-sdk-clerk-electron-0-0-49-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/electron%400.0.49","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_jQthEs2x8kjjkUTmD5JGZ","title":"Clerk JavaScript SDK @clerk/chrome-extension@3.1.89 dependency update","path":"/release/rel_jQthEs2x8kjjkUTmD5JGZ-clerk-javascript-sdk-clerk-chrome-extension-3-1-89-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/chrome-extension%403.1.89","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_r6AyCy6cJlPUjhe8UqDOB","title":"Clerk Mosaic v0.1.4 fixes menu animation and focus ring display","path":"/release/rel_r6AyCy6cJlPUjhe8UqDOB-menu-animations-hold-content-focus-rings-hide-on-mouse-hover","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/mosaic%400.1.4","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_DSybudV42c5WQwPrUkcuP","title":"@clerk/nextjs v7.9.9 removes period from error messages to fix broken URLs","path":"/release/rel_DSybudV42c5WQwPrUkcuP-error-messages-no-longer-end-with-period-broken-urls-fixed","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.9","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_qNKzVQFJ_sN5wEriLqd37","title":"Clerk JavaScript SDK v3.21.1 clarifies Electron and Protect documentation","path":"/release/rel_qNKzVQFJ_sN5wEriLqd37-jsdoc-updates-for-electron-dev-origins-and-protect-rules","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.21.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_GYb1SrochlqfQt9VR_EtE","title":"Clerk Expo SDK v4.7.3 bumps bundled Android SDK to 1.1.10","path":"/release/rel_GYb1SrochlqfQt9VR_EtE-android-sdk-dependency-updated-to-1-1-10","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.7.3","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_CA2qKaupGX_IVqWXLl_kE","title":"Clerk JavaScript SDK @clerk/fastify@3.1.84 dependency update","path":"/release/rel_CA2qKaupGX_IVqWXLl_kE-clerk-javascript-sdk-clerk-fastify-3-1-84-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/fastify%403.1.84","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_AJYH8fecwzV3aYMnF-as-","title":"@clerk/express v2.1.74 dependency update","path":"/release/rel_AJYH8fecwzV3aYMnF-as--clerk-express-v2-1-74-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/express%402.1.74","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_ZUkiBqSSIUylKVna3QJF3","title":"Clerk JavaScript SDK @clerk/nuxt@3.1.8 dependency update","path":"/release/rel_ZUkiBqSSIUylKVna3QJF3-clerk-javascript-sdk-clerk-nuxt-3-1-8-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/nuxt%403.1.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel__cBAj24wNY63CY15pzAPB","title":"Clerk JavaScript SDK @clerk/hono@0.1.84 dependency update","path":"/release/rel__cBAj24wNY63CY15pzAPB-clerk-javascript-sdk-clerk-hono-0-1-84-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/hono%400.1.84","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_L9pIcpOh0Fl8gL57lnGrM","title":"@clerk/vue v2.5.8 dependency update","path":"/release/rel_L9pIcpOh0Fl8gL57lnGrM-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/vue%402.5.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_jIkDoj6pGnNOptqcjpKc8","title":"@clerk/testing v2.2.41 dependency update","path":"/release/rel_jIkDoj6pGnNOptqcjpKc8-clerk-testing-v2-2-41-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/testing%402.2.41","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_aIcbDW7CvvlnZ4zP-lvRa","title":"Clerk JavaScript SDK @clerk/react-router@3.6.29 dependency update","path":"/release/rel_aIcbDW7CvvlnZ4zP-lvRa-clerk-javascript-sdk-clerk-react-router-3-6-29-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.6.29","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_tbbIzCNLM6WBxo5W2CvhI","title":"Clerk JavaScript SDK @clerk/tanstack-react-start@1.6.3 dependency update","path":"/release/rel_tbbIzCNLM6WBxo5W2CvhI-clerk-javascript-sdk-clerk-tanstack-react-start-1-6-3-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/tanstack-react-start%401.6.3","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_IAEY5lskkP638KcqVl5No","title":"Clerk JavaScript SDK @clerk/astro@4.1.8 dependency update","path":"/release/rel_IAEY5lskkP638KcqVl5No-clerk-javascript-sdk-clerk-astro-4-1-8-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/astro%404.1.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_6JR7DfKgGcNOBc_i652sz","title":"Clerk Expo Passkeys @2.0.25 dependency update","path":"/release/rel_6JR7DfKgGcNOBc_i652sz-clerk-expo-passkeys-2-0-25-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo-passkeys%402.0.25","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_lQWeZUJDRpZHwcF8yu4Sh","title":"@clerk/localizations@4.21.1 dependency update","path":"/release/rel_lQWeZUJDRpZHwcF8yu4Sh-clerk-localizations-4-21-1-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/localizations%404.21.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_Su6lKLr0AAMbQ9E9qmK_y","title":"Clerk iOS SDK 1.5.8 breaks Billing has() and read API call shapes","path":"/release/rel_Su6lKLr0AAMbQ9E9qmK_y-billing-has-and-read-api-shapes-simplified-token-sync-fixed","url":"https://github.com/clerk/clerk-ios/releases/tag/1.5.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_blp6R1niqAaweatyBMc5y","title":"Auth0 to lengthen refresh tokens beyond 45 characters","path":"/release/rel_blp6R1niqAaweatyBMc5y-refresh-tokens-get-longer-drop-fixed-width-storage","url":"https://auth0.com/changelog#5rn5HfDjtV2Hx80c3u9dBg","org":{"slug":"auth0","name":"Auth0","avatarUrl":"https://media.releases.sh/orgs/auth0.png","githubHandle":"auth0"},"product":null,"importance":3}],"sections":[{"heading":"A critical fix lands in Better Auth","anchor":"a-critical-fix-lands-in-better-auth","lede":"The week's most urgent item is Better Auth's patch for a Magic Link account-takeover vulnerability, which also covered an OAuth Proxy bug that accepted sign-in state as a provider profile.","releaseIds":["rel_pCPmE8VG7SQmox0trpcN7"],"releases":[{"id":"rel_pCPmE8VG7SQmox0trpcN7","title":"better-auth v1.7.7 patches critical Magic Link account-takeover vulnerability","path":"/release/rel_pCPmE8VG7SQmox0trpcN7-critical-magic-link-takeover-patched-oauth-proxy-state-fix","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.7","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":4}]},{"heading":"Enterprise SSO gets more self-serve, and a pressure valve","anchor":"enterprise-sso-gets-more-self-serve-and-a-pressure-valve","lede":"Clerk spent the week making enterprise connections less dependent on support tickets.","releaseIds":["rel_0aTLwrBruaJl5Eyh3XwEf","rel_x7nhTOb29mumKa7CA1rG0"],"releases":[{"id":"rel_0aTLwrBruaJl5Eyh3XwEf","title":"Clerk launches self-serve Directory Sync for Organization admins","path":"/release/rel_0aTLwrBruaJl5Eyh3XwEf-directory-sync-now-self-serve-in-organizationprofile","url":"https://clerk.com/changelog/2026-09-30-self-serve-directory-sync","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":4},{"id":"rel_x7nhTOb29mumKa7CA1rG0","title":"Clerk adds SSO bypass so allowlisted users can sign in by email code","path":"/release/rel_x7nhTOb29mumKa7CA1rG0-sso-bypass-allowlisted-users-sign-in-via-email-code","url":"https://clerk.com/changelog/2026-09-29-sso-bypass","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3}]},{"heading":"Clerk's JavaScript SDK ships a broad release train","anchor":"clerks-javascript-sdk-ships-a-broad-release-train","lede":"Clerk's JavaScript SDK cut a long series of coordinated packages, and the headline change is that custom flows built with useSignIn() and useSignUp() now handle Clerk Protect challenges automatically — the challenge surfaces in a modal and the method returns once the user passes it, with SSO challenges appearing back at <HandleSSOCallback />.","releaseIds":["rel_bC5YageFWXiT6RlZ0o6uJ","rel_Z_E0pQ4EuUowvM4wS2M6d","rel_43wMT4UcIYGWtjsVADo1G","rel_OL7q0XNmXE4iFl8TuSCLa","rel_LNeBL7dmHGWe7reggYbfV","rel_jQthEs2x8kjjkUTmD5JGZ","rel_r6AyCy6cJlPUjhe8UqDOB","rel_DSybudV42c5WQwPrUkcuP","rel_qNKzVQFJ_sN5wEriLqd37","rel_GYb1SrochlqfQt9VR_EtE","rel_CA2qKaupGX_IVqWXLl_kE","rel_AJYH8fecwzV3aYMnF-as-","rel_ZUkiBqSSIUylKVna3QJF3","rel__cBAj24wNY63CY15pzAPB","rel_L9pIcpOh0Fl8gL57lnGrM","rel_jIkDoj6pGnNOptqcjpKc8","rel_aIcbDW7CvvlnZ4zP-lvRa","rel_tbbIzCNLM6WBxo5W2CvhI","rel_IAEY5lskkP638KcqVl5No","rel_6JR7DfKgGcNOBc_i652sz","rel_lQWeZUJDRpZHwcF8yu4Sh"],"releases":[{"id":"rel_bC5YageFWXiT6RlZ0o6uJ","title":"@clerk/clerk-js@6.36.0 handles Clerk Protect challenges in custom flows","path":"/release/rel_bC5YageFWXiT6RlZ0o6uJ-custom-sign-in-sign-up-flows-handle-clerk-protect-challenges-automatically","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.36.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_Z_E0pQ4EuUowvM4wS2M6d","title":"Clerk UI v1.38.0 handles Protect challenges in custom sign-in and sign-up flows","path":"/release/rel_Z_E0pQ4EuUowvM4wS2M6d-custom-flows-auto-handle-clerk-protect-challenges","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/ui%401.38.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_43wMT4UcIYGWtjsVADo1G","title":"@clerk/react@6.17.4 handles Clerk Protect challenges in custom flows","path":"/release/rel_43wMT4UcIYGWtjsVADo1G-usesignin-usesignup-now-handle-protect-challenges-automatically","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/react%406.17.4","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_OL7q0XNmXE4iFl8TuSCLa","title":"@clerk/shared@4.37.1 handles Clerk Protect challenges in custom flows","path":"/release/rel_OL7q0XNmXE4iFl8TuSCLa-usesignin-and-usesignup-now-handle-protect-challenges-automatically","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.37.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_LNeBL7dmHGWe7reggYbfV","title":"Clerk JavaScript SDK @clerk/electron@0.0.49 dependency update","path":"/release/rel_LNeBL7dmHGWe7reggYbfV-clerk-javascript-sdk-clerk-electron-0-0-49-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/electron%400.0.49","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_jQthEs2x8kjjkUTmD5JGZ","title":"Clerk JavaScript SDK @clerk/chrome-extension@3.1.89 dependency update","path":"/release/rel_jQthEs2x8kjjkUTmD5JGZ-clerk-javascript-sdk-clerk-chrome-extension-3-1-89-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/chrome-extension%403.1.89","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_r6AyCy6cJlPUjhe8UqDOB","title":"Clerk Mosaic v0.1.4 fixes menu animation and focus ring display","path":"/release/rel_r6AyCy6cJlPUjhe8UqDOB-menu-animations-hold-content-focus-rings-hide-on-mouse-hover","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/mosaic%400.1.4","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_DSybudV42c5WQwPrUkcuP","title":"@clerk/nextjs v7.9.9 removes period from error messages to fix broken URLs","path":"/release/rel_DSybudV42c5WQwPrUkcuP-error-messages-no-longer-end-with-period-broken-urls-fixed","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.9","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_qNKzVQFJ_sN5wEriLqd37","title":"Clerk JavaScript SDK v3.21.1 clarifies Electron and Protect documentation","path":"/release/rel_qNKzVQFJ_sN5wEriLqd37-jsdoc-updates-for-electron-dev-origins-and-protect-rules","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.21.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_GYb1SrochlqfQt9VR_EtE","title":"Clerk Expo SDK v4.7.3 bumps bundled Android SDK to 1.1.10","path":"/release/rel_GYb1SrochlqfQt9VR_EtE-android-sdk-dependency-updated-to-1-1-10","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.7.3","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_CA2qKaupGX_IVqWXLl_kE","title":"Clerk JavaScript SDK @clerk/fastify@3.1.84 dependency update","path":"/release/rel_CA2qKaupGX_IVqWXLl_kE-clerk-javascript-sdk-clerk-fastify-3-1-84-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/fastify%403.1.84","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_AJYH8fecwzV3aYMnF-as-","title":"@clerk/express v2.1.74 dependency update","path":"/release/rel_AJYH8fecwzV3aYMnF-as--clerk-express-v2-1-74-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/express%402.1.74","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_ZUkiBqSSIUylKVna3QJF3","title":"Clerk JavaScript SDK @clerk/nuxt@3.1.8 dependency update","path":"/release/rel_ZUkiBqSSIUylKVna3QJF3-clerk-javascript-sdk-clerk-nuxt-3-1-8-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/nuxt%403.1.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel__cBAj24wNY63CY15pzAPB","title":"Clerk JavaScript SDK @clerk/hono@0.1.84 dependency update","path":"/release/rel__cBAj24wNY63CY15pzAPB-clerk-javascript-sdk-clerk-hono-0-1-84-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/hono%400.1.84","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_L9pIcpOh0Fl8gL57lnGrM","title":"@clerk/vue v2.5.8 dependency update","path":"/release/rel_L9pIcpOh0Fl8gL57lnGrM-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/vue%402.5.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_jIkDoj6pGnNOptqcjpKc8","title":"@clerk/testing v2.2.41 dependency update","path":"/release/rel_jIkDoj6pGnNOptqcjpKc8-clerk-testing-v2-2-41-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/testing%402.2.41","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_aIcbDW7CvvlnZ4zP-lvRa","title":"Clerk JavaScript SDK @clerk/react-router@3.6.29 dependency update","path":"/release/rel_aIcbDW7CvvlnZ4zP-lvRa-clerk-javascript-sdk-clerk-react-router-3-6-29-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.6.29","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_tbbIzCNLM6WBxo5W2CvhI","title":"Clerk JavaScript SDK @clerk/tanstack-react-start@1.6.3 dependency update","path":"/release/rel_tbbIzCNLM6WBxo5W2CvhI-clerk-javascript-sdk-clerk-tanstack-react-start-1-6-3-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/tanstack-react-start%401.6.3","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_IAEY5lskkP638KcqVl5No","title":"Clerk JavaScript SDK @clerk/astro@4.1.8 dependency update","path":"/release/rel_IAEY5lskkP638KcqVl5No-clerk-javascript-sdk-clerk-astro-4-1-8-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/astro%404.1.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_6JR7DfKgGcNOBc_i652sz","title":"Clerk Expo Passkeys @2.0.25 dependency update","path":"/release/rel_6JR7DfKgGcNOBc_i652sz-clerk-expo-passkeys-2-0-25-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo-passkeys%402.0.25","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null},{"id":"rel_lQWeZUJDRpZHwcF8yu4Sh","title":"@clerk/localizations@4.21.1 dependency update","path":"/release/rel_lQWeZUJDRpZHwcF8yu4Sh-clerk-localizations-4-21-1-dependency-update","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/localizations%404.21.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":null}]},{"heading":"Breaking changes to plan for","anchor":"breaking-changes-to-plan-for","lede":"Two smaller releases carry upgrade work.","releaseIds":["rel_Su6lKLr0AAMbQ9E9qmK_y","rel_blp6R1niqAaweatyBMc5y"],"releases":[{"id":"rel_Su6lKLr0AAMbQ9E9qmK_y","title":"Clerk iOS SDK 1.5.8 breaks Billing has() and read API call shapes","path":"/release/rel_Su6lKLr0AAMbQ9E9qmK_y-billing-has-and-read-api-shapes-simplified-token-sync-fixed","url":"https://github.com/clerk/clerk-ios/releases/tag/1.5.8","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_blp6R1niqAaweatyBMc5y","title":"Auth0 to lengthen refresh tokens beyond 45 characters","path":"/release/rel_blp6R1niqAaweatyBMc5y-refresh-tokens-get-longer-drop-fixed-width-storage","url":"https://auth0.com/changelog#5rn5HfDjtV2Hx80c3u9dBg","org":{"slug":"auth0","name":"Auth0","avatarUrl":"https://media.releases.sh/orgs/auth0.png","githubHandle":"auth0"},"product":null,"importance":3}]}]}}