Skip to content

Bump @clerk/express from 2.0.1 to 2.1.17#45

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/clerk/express-2.1.17
Open

Bump @clerk/express from 2.0.1 to 2.1.17#45
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/clerk/express-2.1.17

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 18, 2026

Bumps @clerk/express from 2.0.1 to 2.1.17.

Release notes

Sourced from @​clerk/express's releases.

@​clerk/express@​2.1.17

Patch Changes

@​clerk/express@​2.1.16

Patch Changes

@​clerk/express@​2.1.15

Patch Changes

  • Forward all AuthenticateRequestOptions and VerifyTokenOptions passed to clerkMiddleware() through to the backend authenticateRequest() call. Previously only a hand-picked subset was forwarded, so options like organizationSyncOptions, skipJwksCache, and headerType were accepted by the TypeScript types but silently ignored at runtime — the same class of bug that caused clockSkewInMs to be dropped. (#8370) by @​jacekradko

    Additionally, when apiUrl or apiVersion are passed to clerkMiddleware() and no custom clerkClient is supplied, the middleware now builds a per-middleware ClerkClient configured with those values instead of using the env-only default singleton. This is required because @clerk/backend pins apiUrl/apiVersion at client construction time and ignores runtime overrides on authenticateRequest(). Passing your own clerkClient continues to take precedence.

  • Updated dependencies [0ab09a8, 6408ab6, 5cda3ee]:

    • @​clerk/backend@​3.4.7
    • @​clerk/shared@​4.10.2

@​clerk/express@​2.1.14

Patch Changes

  • Updated dependencies [7a5892f]:
    • @​clerk/backend@​3.4.6
    • @​clerk/shared@​4.10.1

@​clerk/express@​2.1.13

Patch Changes

Changelog

Sourced from @​clerk/express's changelog.

2.1.17

Patch Changes

2.1.16

Patch Changes

2.1.15

Patch Changes

  • Forward all AuthenticateRequestOptions and VerifyTokenOptions passed to clerkMiddleware() through to the backend authenticateRequest() call. Previously only a hand-picked subset was forwarded, so options like organizationSyncOptions, skipJwksCache, and headerType were accepted by the TypeScript types but silently ignored at runtime — the same class of bug that caused clockSkewInMs to be dropped. (#8370) by @​jacekradko

    Additionally, when apiUrl or apiVersion are passed to clerkMiddleware() and no custom clerkClient is supplied, the middleware now builds a per-middleware ClerkClient configured with those values instead of using the env-only default singleton. This is required because @clerk/backend pins apiUrl/apiVersion at client construction time and ignores runtime overrides on authenticateRequest(). Passing your own clerkClient continues to take precedence.

  • Updated dependencies [0ab09a8, 6408ab6, 5cda3ee]:

    • @​clerk/backend@​3.4.7
    • @​clerk/shared@​4.10.2

2.1.14

Patch Changes

  • Updated dependencies [7a5892f]:
    • @​clerk/backend@​3.4.6
    • @​clerk/shared@​4.10.1

2.1.13

Patch Changes

2.1.12

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​clerk/express since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@clerk/express](https://github.com/clerk/javascript/tree/HEAD/packages/express) from 2.0.1 to 2.1.17.
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/express/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/express@2.1.17/packages/express)

---
updated-dependencies:
- dependency-name: "@clerk/express"
  dependency-version: 2.1.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants