{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_HRRY1V0f-87t6rdTxN7gs","weekStart":"2026-11-02","title":"Clerk tightens session control as Better Auth hardens its core","intro":"Clerk shipped per-session expiry overrides, separate native-app session lifetimes, and minimum-version enforcement across mobile SDKs, while Better Auth closed a run of session-revocation and OAuth holes and began rejecting repeated authorize parameters.","body":"### Session control gets granular\n\nClerk's biggest theme this week was making session lifetimes settings you can actually aim. [Per-session expiry overrides](/release/rel_orqtgmsu0invKg7KKiElw-clerk-adds-per-session-expiry-overrides-and-session-token-shortcodes) let you set one session's `expire_at` anywhere from five minutes to ten years through a new Backend API endpoint, with new session token shortcodes exposing a session's age and expiry to custom claims. Alongside it, [native sessions now have their own maximum lifetime](/release/rel_qio7_BzquPblugB_gYngd-clerk-adds-separate-maximum-session-lifetimes-for-native-apps) separate from web browser sessions — handy for shared devices and long-lived mobile apps, though the setting is a paid-plan feature in production.\n\nThe same instinct shows up on mobile: [minimum app version enforcement](/release/rel_2aCFlaLtOk0mL7ODgsQiC-clerk-adds-minimum-app-version-enforcement-for-ios-android-and-expo) lets you pin a floor per iOS and Android app from the Dashboard, blocking old builds with an update screen while keeping users signed in. The [iOS SDK's update screen](/release/rel_t9HUkzjpoFX0KZ4JCBlwD-clerk-ios-sdk-1-7-0-adds-minimum-version-update-screen-and-password-reset) landed the client side, and the [iOS device-token and magic-link fixes](/release/rel__z7mU31Lacau4XMAYYuAS-clerk-ios-sdk-1-7-1-keeps-device-token-and-earlier-magic-link-on-resend) keep identity intact when the cached client is unreadable or a resend is rejected.\n\n### Better Auth's security sweep\n\nBetter Auth spent the week in the weeds of session correctness, and the aggregate is a meaningful hardening pass. [Revoked sessions can no longer linger](/release/rel_eOhfCCtsV7-NxQyoEHk04-better-auth-v1-7-16-ends-revoked-sessions-and-enforces-phone-verification) via secondary storage or the cookie cache, phone numbers are stored only after verification, and OAuth's string `\"false\"` is no longer read as verified. Follow-ups tightened [revoke-all-sessions races](/release/rel_Vh9FrbCyJMG3yk8FtxZ7c-better-auth-v1-7-18-fixes-revoke-all-sessions-race-with-secondary-storage), then [remembered sign-ins, phone linking, and TOTP with API key sessions](/release/rel_ZvVawYJ--3T_Qi2QgrJTN-better-auth-v1-7-17-fixes-session-revocation-phone-number-and-totp-issues). The newest beta goes further on OAuth: [repeated authorize parameters in form POSTs](/release/rel_cYY1BwdzxLXvLx2Wg73Io-better-auth-v1-8-0-beta-6-rejects-repeated-oauth-authorize-parameters) now return `invalid_request` instead of silently using the last value.\n\n### Logs, groups, and directory sync\n\nClerk's observability story widened. [Email events are now in Application Logs and GET /v1/logs](/release/rel_Mdp68s3UecMgIgAogyOO_-clerk-email-events-now-appear-in-application-logs-and-the-backend-api), filterable by recipient, and [sign-ins and sign-ups collapse into single rows](/release/rel_fTxq6ZgvUJrGZYy-V26LG-clerk-application-logs-group-sign-ins-and-sign-ups-into-single-rows) with event counts and outcomes (pass `view=flat` for the old shape). Directory Sync gained [group webhooks and a pause switch](/release/rel_sJ_nlO1Tdqu9FwfvubjL4-clerk-adds-group-webhooks-and-pause-to-directory-sync), and the backend ships [typed narrowing for those group events](/release/rel_yPCTXxRnNI1nvkUKcbPQD-clerk-javascript-sdk-3-27-0-narrows-directory-group-webhook-events).\n\n### SDK housekeeping worth noticing\n\nThe JavaScript SDK's [10-second React Native token timeouts and safer sign-out](/release/rel_tI7WD2Gj4Cmko5A7lEtnR-clerk-javascript-sdk-6-42-3-fixes-startup-hangs-and-sign-out-after-sign-up) avert hangs, the [Chrome extension SDK stops loading Device Intelligence scripts remotely](/release/rel_KzZaIG7Y1rJDRXfSVy4Nb-clerk-chrome-extension-sdk-3-1-105-blocks-remote-device-intelligence-scripts), and Mosaic added [drag-and-drop avatar and logo uploads](/release/rel_atPezjSnZeKfiNl26iWar-clerk-mosaic-0-2-2-adds-drag-and-drop-uploads-to-avatar-and-logo-rows). Two changes ask for migration: [rootAuthLoader no longer takes an options argument](/release/rel_6ebPzgCpy03wIFWZev0K8-clerk-react-router-sdk-3-7-0-removes-rootauthloader-options-argument) in React Router, and [Apple sign-in now throws when email verification is required](/release/rel_a8XGwmWGQmC_LADZYHnq7-clerk-javascript-sdk-clerk-expo-4-15-1-throws-error-on-apple-sign-in-email) instead of failing silently. A broad wave of dependency bumps carried the rest of the week, plus a single [Auth release candidate](/release/rel_b2llFcK4DZJ7uxD7Gt--u-supabase-auth-v2-198-0-rc-38-release-candidate) with no notes to speak of.","releaseIds":["rel_orqtgmsu0invKg7KKiElw","rel_qio7_BzquPblugB_gYngd","rel_2aCFlaLtOk0mL7ODgsQiC","rel_t9HUkzjpoFX0KZ4JCBlwD","rel__z7mU31Lacau4XMAYYuAS","rel_eOhfCCtsV7-NxQyoEHk04","rel_Vh9FrbCyJMG3yk8FtxZ7c","rel_ZvVawYJ--3T_Qi2QgrJTN","rel_cYY1BwdzxLXvLx2Wg73Io","rel_Mdp68s3UecMgIgAogyOO_","rel_fTxq6ZgvUJrGZYy-V26LG","rel_sJ_nlO1Tdqu9FwfvubjL4","rel_yPCTXxRnNI1nvkUKcbPQD","rel_tI7WD2Gj4Cmko5A7lEtnR","rel_KzZaIG7Y1rJDRXfSVy4Nb","rel_atPezjSnZeKfiNl26iWar","rel_6ebPzgCpy03wIFWZev0K8","rel_a8XGwmWGQmC_LADZYHnq7","rel_b2llFcK4DZJ7uxD7Gt--u"],"releaseCount":34,"generatedAt":"2026-11-09T06:17:36.905Z","releases":[{"id":"rel_orqtgmsu0invKg7KKiElw","title":"Clerk adds per-session expiry overrides and session token shortcodes","path":"/release/rel_orqtgmsu0invKg7KKiElw-session-expiry-now-editable-per-session-tokens-expose-age","url":"https://clerk.com/changelog/2026-11-06-custom-session-limits","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":2,"enhancements":0},"publishedAt":"2026-11-06T00:00:00.000Z"},{"id":"rel_qio7_BzquPblugB_gYngd","title":"Clerk adds separate maximum session lifetimes for native apps","path":"/release/rel_qio7_BzquPblugB_gYngd-native-sessions-get-their-own-lifetime-setting","url":"https://clerk.com/changelog/2026-11-04-native-session-lifetimes","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-11-04T00:00:00.000Z"},{"id":"rel_2aCFlaLtOk0mL7ODgsQiC","title":"Clerk adds minimum app version enforcement for iOS, Android, and Expo","path":"/release/rel_2aCFlaLtOk0mL7ODgsQiC-minimum-app-version-enforcement-for-native-apps","url":"https://clerk.com/changelog/2026-11-03-minimum-app-version","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-11-03T00:00:00.000Z"},{"id":"rel_t9HUkzjpoFX0KZ4JCBlwD","title":"Clerk iOS SDK 1.7.0 adds minimum-version update screen and password-reset reverification","path":"/release/rel_t9HUkzjpoFX0KZ4JCBlwD-update-screen-for-outdated-apps-reset-password-reverify","url":"https://github.com/clerk/clerk-ios/releases/tag/1.7.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":2,"features":2,"enhancements":0},"publishedAt":"2026-11-02T22:56:29.000Z"},{"id":"rel__z7mU31Lacau4XMAYYuAS","title":"Clerk iOS SDK 1.7.1 keeps device token and earlier magic link on resend","path":"/release/rel__z7mU31Lacau4XMAYYuAS-device-token-persists-earlier-magic-link-survives-rejected-resend","url":"https://github.com/clerk/clerk-ios/releases/tag/1.7.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":3,"features":0,"enhancements":0},"publishedAt":"2026-11-03T14:37:32.000Z"},{"id":"rel_eOhfCCtsV7-NxQyoEHk04","title":"better-auth v1.7.16 ends revoked sessions and enforces phone verification","path":"/release/rel_eOhfCCtsV7-NxQyoEHk04-revoked-sessions-end-phone-numbers-require-verification","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":20,"features":0,"enhancements":0},"publishedAt":"2026-11-03T21:22:51.000Z"},{"id":"rel_Vh9FrbCyJMG3yk8FtxZ7c","title":"better-auth v1.7.18 fixes revoke-all-sessions race with secondary storage","path":"/release/rel_Vh9FrbCyJMG3yk8FtxZ7c-revoke-all-sessions-now-catches-concurrently-created-ones","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.18","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":4,"features":0,"enhancements":0},"publishedAt":"2026-11-05T14:56:33.000Z"},{"id":"rel_ZvVawYJ--3T_Qi2QgrJTN","title":"better-auth v1.7.17 fixes session revocation, phone number, and TOTP issues","path":"/release/rel_ZvVawYJ--3T_Qi2QgrJTN-remembered-sessions-survive-rememberme-false-phone-numbers-no-longer-clobbered","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.17","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":9,"features":0,"enhancements":0},"publishedAt":"2026-11-04T15:52:53.000Z"},{"id":"rel_cYY1BwdzxLXvLx2Wg73Io","title":"better-auth v1.8.0-beta.6 rejects repeated OAuth authorize parameters","path":"/release/rel_cYY1BwdzxLXvLx2Wg73Io-repeated-oauth-authorize-params-now-rejected-dpop-key-binding","url":"https://github.com/better-auth/better-auth/releases/tag/v1.8.0-beta.6","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":1},"publishedAt":"2026-11-05T15:26:11.000Z"},{"id":"rel_Mdp68s3UecMgIgAogyOO_","title":"Clerk email events now appear in Application Logs and the Backend API","path":"/release/rel_Mdp68s3UecMgIgAogyOO_-email-events-land-in-application-logs-and-get-v1-logs","url":"https://clerk.com/changelog/2026-11-06-email-events-in-application-logs","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":3},"publishedAt":"2026-11-06T00:00:00.000Z"},{"id":"rel_fTxq6ZgvUJrGZYy-V26LG","title":"Clerk Application Logs group sign-ins and sign-ups into single rows","path":"/release/rel_fTxq6ZgvUJrGZYy-V26LG-sign-ins-and-sign-ups-now-grouped-into-one-row","url":"https://clerk.com/changelog/2026-11-06-log-groups","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":0,"enhancements":2},"publishedAt":"2026-11-06T00:00:00.000Z"},{"id":"rel_sJ_nlO1Tdqu9FwfvubjL4","title":"Clerk adds group webhooks and pause to Directory Sync","path":"/release/rel_sJ_nlO1Tdqu9FwfvubjL4-directory-sync-gets-group-webhooks-directories-pausable","url":"https://clerk.com/changelog/2026-11-03-directory-sync-updates","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":4,"enhancements":1},"publishedAt":"2026-11-03T00:00:00.000Z"},{"id":"rel_yPCTXxRnNI1nvkUKcbPQD","title":"Clerk JavaScript SDK 3.27.0 narrows directory group webhook events","path":"/release/rel_yPCTXxRnNI1nvkUKcbPQD-directory-sync-group-webhook-events-now-typed","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.27.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-11-05T13:59:23.000Z"},{"id":"rel_tI7WD2Gj4Cmko5A7lEtnR","title":"Clerk JavaScript SDK 6.42.3 fixes startup hangs and sign-out after sign-up","path":"/release/rel_tI7WD2Gj4Cmko5A7lEtnR-rn-token-requests-time-out-and-retry-sign-up-no-longer-signs-users-out","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.42.3","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":4,"features":0,"enhancements":0},"publishedAt":"2026-11-05T13:59:47.000Z"},{"id":"rel_KzZaIG7Y1rJDRXfSVy4Nb","title":"Clerk Chrome extension SDK 3.1.105 blocks remote Device Intelligence scripts","path":"/release/rel_KzZaIG7Y1rJDRXfSVy4Nb-device-intelligence-scripts-no-longer-load-from-remote-urls","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/chrome-extension%403.1.105","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-11-05T13:58:47.000Z"},{"id":"rel_atPezjSnZeKfiNl26iWar","title":"Clerk Mosaic 0.2.2 adds drag-and-drop uploads to avatar and logo rows","path":"/release/rel_atPezjSnZeKfiNl26iWar-drag-image-onto-profile-avatar-or-org-logo-to-upload","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/mosaic%400.2.2","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":8,"features":3,"enhancements":4},"publishedAt":"2026-11-05T13:59:20.000Z"},{"id":"rel_6ebPzgCpy03wIFWZev0K8","title":"Clerk React Router SDK 3.7.0 removes rootAuthLoader options argument","path":"/release/rel_6ebPzgCpy03wIFWZev0K8-rootauthloader-drops-options-argument","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.7.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":0,"enhancements":1},"publishedAt":"2026-11-05T13:58:59.000Z"},{"id":"rel_a8XGwmWGQmC_LADZYHnq7","title":"Clerk JavaScript SDK @clerk/expo 4.15.1 throws error on Apple sign-in email verification","path":"/release/rel_a8XGwmWGQmC_LADZYHnq7-apple-sign-in-now-errors-when-email-verification-is-needed","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.15.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-11-05T13:59:02.000Z"},{"id":"rel_b2llFcK4DZJ7uxD7Gt--u","title":"Supabase Auth v2.198.0-rc.38 release candidate","path":"/release/rel_b2llFcK4DZJ7uxD7Gt--u-supabase-auth-v2-198-0-rc-38-release-candidate","url":"https://github.com/supabase/auth/releases/tag/rc2.198.0-rc.38","org":{"slug":"supabase","name":"Supabase","avatarUrl":"https://media.releases.sh/orgs/supabase.png","githubHandle":"supabase"},"product":{"slug":"auth","name":"Auth"},"importance":1,"composition":null,"publishedAt":"2026-11-06T23:59:53.000Z"}],"sections":[{"heading":"Session control gets granular","anchor":"session-control-gets-granular","lede":"Clerk's biggest theme this week was making session lifetimes settings you can actually aim.","releaseIds":["rel_orqtgmsu0invKg7KKiElw","rel_qio7_BzquPblugB_gYngd","rel_2aCFlaLtOk0mL7ODgsQiC","rel_t9HUkzjpoFX0KZ4JCBlwD","rel__z7mU31Lacau4XMAYYuAS"],"releases":[{"id":"rel_orqtgmsu0invKg7KKiElw","title":"Clerk adds per-session expiry overrides and session token shortcodes","path":"/release/rel_orqtgmsu0invKg7KKiElw-session-expiry-now-editable-per-session-tokens-expose-age","url":"https://clerk.com/changelog/2026-11-06-custom-session-limits","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":2,"enhancements":0},"publishedAt":"2026-11-06T00:00:00.000Z"},{"id":"rel_qio7_BzquPblugB_gYngd","title":"Clerk adds separate maximum session lifetimes for native apps","path":"/release/rel_qio7_BzquPblugB_gYngd-native-sessions-get-their-own-lifetime-setting","url":"https://clerk.com/changelog/2026-11-04-native-session-lifetimes","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-11-04T00:00:00.000Z"},{"id":"rel_2aCFlaLtOk0mL7ODgsQiC","title":"Clerk adds minimum app version enforcement for iOS, Android, and Expo","path":"/release/rel_2aCFlaLtOk0mL7ODgsQiC-minimum-app-version-enforcement-for-native-apps","url":"https://clerk.com/changelog/2026-11-03-minimum-app-version","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-11-03T00:00:00.000Z"},{"id":"rel_t9HUkzjpoFX0KZ4JCBlwD","title":"Clerk iOS SDK 1.7.0 adds minimum-version update screen and password-reset reverification","path":"/release/rel_t9HUkzjpoFX0KZ4JCBlwD-update-screen-for-outdated-apps-reset-password-reverify","url":"https://github.com/clerk/clerk-ios/releases/tag/1.7.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":2,"features":2,"enhancements":0},"publishedAt":"2026-11-02T22:56:29.000Z"},{"id":"rel__z7mU31Lacau4XMAYYuAS","title":"Clerk iOS SDK 1.7.1 keeps device token and earlier magic link on resend","path":"/release/rel__z7mU31Lacau4XMAYYuAS-device-token-persists-earlier-magic-link-survives-rejected-resend","url":"https://github.com/clerk/clerk-ios/releases/tag/1.7.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":3,"features":0,"enhancements":0},"publishedAt":"2026-11-03T14:37:32.000Z"}]},{"heading":"Better Auth's security sweep","anchor":"better-auths-security-sweep","lede":"Better Auth spent the week in the weeds of session correctness, and the aggregate is a meaningful hardening pass.","releaseIds":["rel_eOhfCCtsV7-NxQyoEHk04","rel_Vh9FrbCyJMG3yk8FtxZ7c","rel_ZvVawYJ--3T_Qi2QgrJTN","rel_cYY1BwdzxLXvLx2Wg73Io"],"releases":[{"id":"rel_eOhfCCtsV7-NxQyoEHk04","title":"better-auth v1.7.16 ends revoked sessions and enforces phone verification","path":"/release/rel_eOhfCCtsV7-NxQyoEHk04-revoked-sessions-end-phone-numbers-require-verification","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":20,"features":0,"enhancements":0},"publishedAt":"2026-11-03T21:22:51.000Z"},{"id":"rel_Vh9FrbCyJMG3yk8FtxZ7c","title":"better-auth v1.7.18 fixes revoke-all-sessions race with secondary storage","path":"/release/rel_Vh9FrbCyJMG3yk8FtxZ7c-revoke-all-sessions-now-catches-concurrently-created-ones","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.18","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":4,"features":0,"enhancements":0},"publishedAt":"2026-11-05T14:56:33.000Z"},{"id":"rel_ZvVawYJ--3T_Qi2QgrJTN","title":"better-auth v1.7.17 fixes session revocation, phone number, and TOTP issues","path":"/release/rel_ZvVawYJ--3T_Qi2QgrJTN-remembered-sessions-survive-rememberme-false-phone-numbers-no-longer-clobbered","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.17","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":9,"features":0,"enhancements":0},"publishedAt":"2026-11-04T15:52:53.000Z"},{"id":"rel_cYY1BwdzxLXvLx2Wg73Io","title":"better-auth v1.8.0-beta.6 rejects repeated OAuth authorize parameters","path":"/release/rel_cYY1BwdzxLXvLx2Wg73Io-repeated-oauth-authorize-params-now-rejected-dpop-key-binding","url":"https://github.com/better-auth/better-auth/releases/tag/v1.8.0-beta.6","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":1},"publishedAt":"2026-11-05T15:26:11.000Z"}]},{"heading":"Logs, groups, and directory sync","anchor":"logs-groups-and-directory-sync","lede":"Clerk's observability story widened.","releaseIds":["rel_Mdp68s3UecMgIgAogyOO_","rel_fTxq6ZgvUJrGZYy-V26LG","rel_sJ_nlO1Tdqu9FwfvubjL4","rel_yPCTXxRnNI1nvkUKcbPQD"],"releases":[{"id":"rel_Mdp68s3UecMgIgAogyOO_","title":"Clerk email events now appear in Application Logs and the Backend API","path":"/release/rel_Mdp68s3UecMgIgAogyOO_-email-events-land-in-application-logs-and-get-v1-logs","url":"https://clerk.com/changelog/2026-11-06-email-events-in-application-logs","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":1,"enhancements":3},"publishedAt":"2026-11-06T00:00:00.000Z"},{"id":"rel_fTxq6ZgvUJrGZYy-V26LG","title":"Clerk Application Logs group sign-ins and sign-ups into single rows","path":"/release/rel_fTxq6ZgvUJrGZYy-V26LG-sign-ins-and-sign-ups-now-grouped-into-one-row","url":"https://clerk.com/changelog/2026-11-06-log-groups","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":0,"enhancements":2},"publishedAt":"2026-11-06T00:00:00.000Z"},{"id":"rel_sJ_nlO1Tdqu9FwfvubjL4","title":"Clerk adds group webhooks and pause to Directory Sync","path":"/release/rel_sJ_nlO1Tdqu9FwfvubjL4-directory-sync-gets-group-webhooks-directories-pausable","url":"https://clerk.com/changelog/2026-11-03-directory-sync-updates","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":4,"enhancements":1},"publishedAt":"2026-11-03T00:00:00.000Z"},{"id":"rel_yPCTXxRnNI1nvkUKcbPQD","title":"Clerk JavaScript SDK 3.27.0 narrows directory group webhook events","path":"/release/rel_yPCTXxRnNI1nvkUKcbPQD-directory-sync-group-webhook-events-now-typed","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.27.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-11-05T13:59:23.000Z"}]},{"heading":"SDK housekeeping worth noticing","anchor":"sdk-housekeeping-worth-noticing","lede":"The JavaScript SDK's 10-second React Native token timeouts and safer sign-out avert hangs, the Chrome extension SDK stops loading Device Intelligence scripts remotely, and Mosaic added drag-and-drop avatar and logo uploads.","releaseIds":["rel_tI7WD2Gj4Cmko5A7lEtnR","rel_KzZaIG7Y1rJDRXfSVy4Nb","rel_atPezjSnZeKfiNl26iWar","rel_6ebPzgCpy03wIFWZev0K8","rel_a8XGwmWGQmC_LADZYHnq7","rel_b2llFcK4DZJ7uxD7Gt--u"],"releases":[{"id":"rel_tI7WD2Gj4Cmko5A7lEtnR","title":"Clerk JavaScript SDK 6.42.3 fixes startup hangs and sign-out after sign-up","path":"/release/rel_tI7WD2Gj4Cmko5A7lEtnR-rn-token-requests-time-out-and-retry-sign-up-no-longer-signs-users-out","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.42.3","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":4,"features":0,"enhancements":0},"publishedAt":"2026-11-05T13:59:47.000Z"},{"id":"rel_KzZaIG7Y1rJDRXfSVy4Nb","title":"Clerk Chrome extension SDK 3.1.105 blocks remote Device Intelligence scripts","path":"/release/rel_KzZaIG7Y1rJDRXfSVy4Nb-device-intelligence-scripts-no-longer-load-from-remote-urls","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/chrome-extension%403.1.105","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-11-05T13:58:47.000Z"},{"id":"rel_atPezjSnZeKfiNl26iWar","title":"Clerk Mosaic 0.2.2 adds drag-and-drop uploads to avatar and logo rows","path":"/release/rel_atPezjSnZeKfiNl26iWar-drag-image-onto-profile-avatar-or-org-logo-to-upload","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/mosaic%400.2.2","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":8,"features":3,"enhancements":4},"publishedAt":"2026-11-05T13:59:20.000Z"},{"id":"rel_6ebPzgCpy03wIFWZev0K8","title":"Clerk React Router SDK 3.7.0 removes rootAuthLoader options argument","path":"/release/rel_6ebPzgCpy03wIFWZev0K8-rootauthloader-drops-options-argument","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.7.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3,"composition":{"bugs":0,"features":0,"enhancements":1},"publishedAt":"2026-11-05T13:58:59.000Z"},{"id":"rel_a8XGwmWGQmC_LADZYHnq7","title":"Clerk JavaScript SDK @clerk/expo 4.15.1 throws error on Apple sign-in email verification","path":"/release/rel_a8XGwmWGQmC_LADZYHnq7-apple-sign-in-now-errors-when-email-verification-is-needed","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.15.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-11-05T13:59:02.000Z"},{"id":"rel_b2llFcK4DZJ7uxD7Gt--u","title":"Supabase Auth v2.198.0-rc.38 release candidate","path":"/release/rel_b2llFcK4DZJ7uxD7Gt--u-supabase-auth-v2-198-0-rc-38-release-candidate","url":"https://github.com/supabase/auth/releases/tag/rc2.198.0-rc.38","org":{"slug":"supabase","name":"Supabase","avatarUrl":"https://media.releases.sh/orgs/supabase.png","githubHandle":"supabase"},"product":{"slug":"auth","name":"Auth"},"importance":1,"composition":null,"publishedAt":"2026-11-06T23:59:53.000Z"}]}]}}