Clerk's Expo SDK breaks into native pieces while Better Auth patches the edges

Clerk's Expo native components become a package of their own

The biggest change of the week came from Clerk's JavaScript SDK, which pulled the Expo native components — AuthView, UserButton, UserProfileView — into a new @clerk/expo-native-components package. Apps now have to install the package and rebuild, otherwise rendering a native component throws a runtime error spelling out the install steps. The old @clerk/expo/native entry point is deprecated in favor of @clerk/expo/native-components, though it still works with a development warning. There is an upside: projects that skip the package no longer pull in the Clerk iOS and Android SDKs or carry the iOS 17 requirement — but on Android they also stop migrating biometric credentials enrolled with earlier versions, so affected users will have to re-enroll.

The package picked up its own polish afterward, with native components now honoring the proxyUrl passed to ClerkProvider — though applying it takes a new binary, since JS-only OTA updates keep the old behavior.

Expo SDK 58 lands across the whole Clerk family

Clerk spread Expo SDK 58 support through its companion packages in a single sweep. The Expo SDK itself gained the support, as did the native components package, which also fixed an Android compile error and now themes custom user-profile backgrounds and navigation bars on iOS. The biometrics SDK picked it up along with a fix for an iOS compile failure, and the passkeys and Google sign-in packages followed suit.

Session and sign-in correctness

Clerk also spent the week tightening the corners of session handling. iOS sign-outs triggered by a momentary keychain read failure — an app launching in the background before the device is unlocked — are no longer logged out, with the token cache rejecting on the keychain error and retrying once the app is active instead of deleting the token. On the web, session.getToken() stopped trusting navigator.onLine and oidcPrompt values like select_account now actually reach the OAuth provider. JWT verification gained an optional issuer claim check across verifyJwt(), verifyToken(), and authenticateRequest(). Backend users also gained a deprovisioned field set by Directory Sync, and the SignUp flow no longer asks returning users to fill in missing fields after a verification challenge.

On the UI side, UserButton's organization mode was removed in favor of the new OrganizationSwitcher export in Mosaic, and combined mode then defaulted to a larger trigger badging the active organization with the user's avatar — triggerVariant='condensed' restores the old look.

Better Auth and the rest

Better Auth spent the week on correctness behind the scenes. Its beta added a FedCM account chooser for Google sign-in on supported Chrome browsers. The stable line stopped stale cookies surviving expired customSession sessions and made failed password resets leave reset links and OTPs intact. DPoP validation was fixed behind URL-rewriting proxies, while MongoDB pagination and JWKS refetch limits got attention, and later Postgres int8 migration diffs and oversized X-Retry-After values were corrected.

Elsewhere, Clerk's MCP server now connects to your account, letting an agent create apps, configure auth, and manage users within your role's limits, and Auth0 put identifier and phone-country controls for Universal Login into Early Access on all plans.