wobsoriano · Oct 30, 2026 · Oct 30, 2026
diff --git a/.changeset/bump-clerk-js-bundlewatch.md b/.changeset/bump-clerk-js-bundlewatch.md
diff --git a/.changeset/connected-accounts-verification-error-no-animate.md b/.changeset/connected-accounts-verification-error-no-animate.md
diff --git a/.changeset/consolidate-overlapping-dev-dependencies.md b/.changeset/consolidate-overlapping-dev-dependencies.md
diff --git a/.changeset/contact-verify-pending.md b/.changeset/contact-verify-pending.md
diff --git a/.changeset/dark-candles-fly.md b/.changeset/dark-candles-fly.md
diff --git a/.changeset/drop-tslib-runtime-dependency.md b/.changeset/drop-tslib-runtime-dependency.md
diff --git a/.changeset/electron-token-file-mode.md b/.changeset/electron-token-file-mode.md
diff --git a/.changeset/fix-salted-password-digest-order.md b/.changeset/fix-salted-password-digest-order.md
diff --git a/.changeset/fix-stale-agent-docs.md b/.changeset/fix-stale-agent-docs.md
diff --git a/.changeset/google-test-cleanup-on-failure.md b/.changeset/google-test-cleanup-on-failure.md
diff --git a/.changeset/happy-waves-bake.md b/.changeset/happy-waves-bake.md
diff --git a/.changeset/mfa-backup-codes-pending-menu.md b/.changeset/mfa-backup-codes-pending-menu.md
diff --git a/.changeset/mosaic-color-tokens.md b/.changeset/mosaic-color-tokens.md
diff --git a/.changeset/mosaic-email-link-flake.md b/.changeset/mosaic-email-link-flake.md
diff --git a/.changeset/mosaic-localization-key-tree.md b/.changeset/mosaic-localization-key-tree.md
diff --git a/.changeset/mosaic-machine-pre-start-events.md b/.changeset/mosaic-machine-pre-start-events.md
diff --git a/.changeset/mosaic-machine-resume.md b/.changeset/mosaic-machine-resume.md
diff --git a/.changeset/mosaic-machine-state-names.md b/.changeset/mosaic-machine-state-names.md
diff --git a/.changeset/mosaic-menu-press-open-hover-race.md b/.changeset/mosaic-menu-press-open-hover-race.md
diff --git a/.changeset/mosaic-modal-return-history.md b/.changeset/mosaic-modal-return-history.md
diff --git a/.changeset/mosaic-neutral-defaults.md b/.changeset/mosaic-neutral-defaults.md
diff --git a/.changeset/mosaic-passkeys-shared-enterprise-check.md b/.changeset/mosaic-passkeys-shared-enterprise-check.md
diff --git a/.changeset/mosaic-pending-action-adoption.md b/.changeset/mosaic-pending-action-adoption.md
diff --git a/.changeset/mosaic-profile-modal-oauth-return.md b/.changeset/mosaic-profile-modal-oauth-return.md
diff --git a/.changeset/mosaic-profile-test-preload.md b/.changeset/mosaic-profile-test-preload.md
diff --git a/.changeset/mosaic-provider-button.md b/.changeset/mosaic-provider-button.md
diff --git a/.changeset/mosaic-public-props-guide.md b/.changeset/mosaic-public-props-guide.md
diff --git a/.changeset/mosaic-reverification-localized-errors.md b/.changeset/mosaic-reverification-localized-errors.md
diff --git a/.changeset/mosaic-router-search-params.md b/.changeset/mosaic-router-search-params.md
diff --git a/.changeset/mosaic-switcher-mutation-tests.md b/.changeset/mosaic-switcher-mutation-tests.md
diff --git a/.changeset/mosaic-user-profile-combined.md b/.changeset/mosaic-user-profile-combined.md
diff --git a/.changeset/mosaic-user-profile-export.md b/.changeset/mosaic-user-profile-export.md
diff --git a/.changeset/mosaic-user-profile-mutation-tests.md b/.changeset/mosaic-user-profile-mutation-tests.md
diff --git a/.changeset/mosaic-user-profile-step2-tests.md b/.changeset/mosaic-user-profile-step2-tests.md
diff --git a/.changeset/mosaic-user-profile-step3-tests.md b/.changeset/mosaic-user-profile-step3-tests.md
diff --git a/.changeset/open-teeth-hunt.md b/.changeset/open-teeth-hunt.md
diff --git a/.changeset/protect-keep-late-di-token.md b/.changeset/protect-keep-late-di-token.md
diff --git a/.changeset/protect-token-timeout-10s.md b/.changeset/protect-token-timeout-10s.md
diff --git a/.changeset/remove-unused-dev-dependencies.md b/.changeset/remove-unused-dev-dependencies.md
diff --git a/.changeset/shy-pages-share.md b/.changeset/shy-pages-share.md
diff --git a/.changeset/stale-core-3-upgrade-docs.md b/.changeset/stale-core-3-upgrade-docs.md
diff --git a/.changeset/swingset-auto-port.md b/.changeset/swingset-auto-port.md
diff --git a/.changeset/swingset-faker-chaos.md b/.changeset/swingset-faker-chaos.md
diff --git a/.changeset/thin-trains-lose.md b/.changeset/thin-trains-lose.md
diff --git a/.changeset/tidy-invitation-completion.md b/.changeset/tidy-invitation-completion.md
diff --git a/.changeset/token-cache-expiry-on-token.md b/.changeset/token-cache-expiry-on-token.md
diff --git a/.changeset/verify-expo-clerk-ios-pin.md b/.changeset/verify-expo-clerk-ios-pin.md
diff --git a/.changeset/verify-expo-custom-pages.md b/.changeset/verify-expo-custom-pages.md
diff --git a/packages/astro/CHANGELOG.md b/packages/astro/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @clerk/astro
 
+## 4.1.20
+
+### Patch Changes
+
+- Updated dependencies [[`cd21ebe`](https://github.com/clerk/javascript/commit/cd21ebe3922aaa1ff41de9dbaa711725bc1d9520), [`11907aa`](https://github.com/clerk/javascript/commit/11907aa0f17bd9c861ccdd5a469d2694d7a503cf), [`debfc72`](https://github.com/clerk/javascript/commit/debfc72bc2f49a004b20365773824b283bc3cda0)]:
+  - @clerk/backend@3.26.5
+  - @clerk/shared@4.43.1
+
 ## 4.1.19
 
 ### Patch Changes

diff --git a/packages/astro/package.json b/packages/astro/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/astro",
-  "version": "4.1.19",
+  "version": "4.1.20",
   "description": "Clerk SDK for Astro",
   "keywords": [
     "auth",

diff --git a/packages/backend/CHANGELOG.md b/packages/backend/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Change Log
 
+## 3.26.5
+
+### Patch Changes
+
+- `tslib` is no longer installed as a runtime dependency. The published builds never imported it. ([#10521](https://github.com/clerk/javascript/pull/10521)) by [@dominic-clerk](https://github.com/dominic-clerk)
+
+- Add `bcrypt_peppered`, `md5_salted`, `pbkdf2_sha512`, `pbkdf2_sha512_hex`, `sha256_salted`, and `sha512_symfony` to the `PasswordHasher` type, so TypeScript accepts every hasher the `createUser()` JSDoc documents. The JSDoc for `md5_salted` and `sha256_salted` now also shows the `password_digest` format the Backend API accepts: `hash$salt`, not `salt$hash`. ([#10504](https://github.com/clerk/javascript/pull/10504)) by [@manovotny](https://github.com/manovotny)
+
+- Updated dependencies [[`debfc72`](https://github.com/clerk/javascript/commit/debfc72bc2f49a004b20365773824b283bc3cda0)]:
+  - @clerk/shared@4.43.1
+
 ## 3.26.4
 
 ### Patch Changes

diff --git a/packages/backend/package.json b/packages/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/backend",
-  "version": "3.26.4",
+  "version": "3.26.5",
   "description": "Clerk Backend SDK - REST Client for Backend API & JWT verification utilities",
   "homepage": "https://clerk.com/",
   "bugs": {

diff --git a/packages/chrome-extension/CHANGELOG.md b/packages/chrome-extension/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Change Log
 
+## 3.1.103
+
+### Patch Changes
+
+- Updated dependencies [[`cd21ebe`](https://github.com/clerk/javascript/commit/cd21ebe3922aaa1ff41de9dbaa711725bc1d9520), [`690edf2`](https://github.com/clerk/javascript/commit/690edf28f799996cf5d274bb7a1193f8435e3689), [`debfc72`](https://github.com/clerk/javascript/commit/debfc72bc2f49a004b20365773824b283bc3cda0), [`1bce44b`](https://github.com/clerk/javascript/commit/1bce44bed5c54b2c788262462d3ac80391c090f7)]:
+  - @clerk/react@6.18.4
+  - @clerk/clerk-js@6.42.1
+  - @clerk/shared@4.43.1
+  - @clerk/ui@1.42.2
+
 ## 3.1.102
 
 ### Patch Changes

diff --git a/packages/chrome-extension/package.json b/packages/chrome-extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/chrome-extension",
-  "version": "3.1.102",
+  "version": "3.1.103",
   "description": "Clerk SDK for Chrome extensions",
   "keywords": [
     "auth",

diff --git a/packages/clerk-js/CHANGELOG.md b/packages/clerk-js/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Change Log
 
+## 6.42.1
+
+### Patch Changes
+
+- Keep a Device Intelligence result that arrives after ClerkJS has stopped waiting for it, and use it for the next sign-in or sign-up instead of discarding it. Users on slow connections who retry are less likely to have sign-ups blocked by protections that require a Device Intelligence result. ([#10276](https://github.com/clerk/javascript/pull/10276)) by [@mwickett](https://github.com/mwickett)
+
+- Wait up to 10 seconds, instead of 5, for the Device Intelligence check to finish before sending a sign-in or sign-up without its result. This applies when an instance hasn't configured its own limit. Users on slow connections are less likely to have sign-ups blocked by protections that require a Device Intelligence result. ([#10275](https://github.com/clerk/javascript/pull/10275)) by [@mwickett](https://github.com/mwickett)
+
+  Keep the wait bounded when the device clock changes so later attempts can recover after another tab's lock is released.
+
+  The shared loader type reference now documents the same 10-second default.
+
+- Fix `getToken()` returning an expired session token when the device clock runs behind and a token is cached again, or a staler token arrives after a fresher one. ([#10429](https://github.com/clerk/javascript/pull/10429)) by [@Ephem](https://github.com/Ephem)
+
+- Updated dependencies [[`debfc72`](https://github.com/clerk/javascript/commit/debfc72bc2f49a004b20365773824b283bc3cda0)]:
+  - @clerk/shared@4.43.1
+
 ## 6.42.0
 
 ### Minor Changes

diff --git a/packages/clerk-js/package.json b/packages/clerk-js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@clerk/clerk-js",
-  "version": "6.42.0",
+  "version": "6.42.1",
   "description": "Clerk JS library",
   "keywords": [
     "clerk",