Google Workspace and Microsoft Entra SAML now supported; keyless mode gated from CI

Minor Changes

• Internal <ConfigureSSO /> refactor to call new org-scoped enterprise connections FAPI endpoints, replacing the /me/ deprecated scope. (#8671) by @iagodahlem

Patch Changes

• Add support for Google Workspace SAML provider to self-serve SSO (#8690) by @LauraBeatris

• Layer architecture for configure steps per IdP and protocol on <ConfigureSSO /> (#8651) by @LauraBeatris

• Prevent keyless mode from activating in CI and other automated environments in framework SDKs. (#8676) by @mwickett

• Add support for Microsoft Entra SAML provider to self-serve SSO (#8695) by @LauraBeatris

• Replace the telemetry postinstall script with a one-time runtime notice, printed once per process on server runtimes (Node, excluding CI) when the telemetry collector boots against a development instance. Drops the std-env dependency. (#8549) by @jacekradko

  Removing postinstall improves the package's supply-chain posture: @clerk/shared no longer executes arbitrary code at install time, aligning with package-manager defaults that increasingly disable install scripts.

  Browser-only applications with no server-side Clerk runtime (e.g. a Vite SPA) will not surface an in-band notice. Telemetry behavior and opt-out (telemetry={false} or *_CLERK_TELEMETRY_DISABLED) are unchanged; disclosure for these setups is provided at https://clerk.com/docs/telemetry.

• Nest rolldown's shared build chunks under dist/runtime/_chunks/ instead of emitting them flat next to the entry points. The package exposes "./*", which resolves to dist/runtime/*, so the content-hashed internal chunks were being picked up by API-diff tooling whenever a chunk hash shifted. Entry and type resolution are unchanged; the chunks are still referenced by relative path, and external ./_chunks/* package subpaths are blocked. (#8717) by @jacekradko