diff --git a/.changeset/astro-bundled-ui-serialization.md b/.changeset/astro-bundled-ui-serialization.md
deleted file mode 100644
index 23e6ec6f4b4..00000000000
--- a/.changeset/astro-bundled-ui-serialization.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@clerk/astro': patch
----
-
-Fix Astro initialization when bundled `ui` or `prefetchUI: false` is passed to the integration.
diff --git a/.changeset/drawer-select-escape.md b/.changeset/drawer-select-escape.md
deleted file mode 100644
index e0a95dbd5e2..00000000000
--- a/.changeset/drawer-select-escape.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@clerk/ui': patch
----
-
-Fix pressing `Escape` while a `Select` is open inside a `Drawer` (for example the payment method picker in Checkout) dismissing the entire Drawer. `Escape` now closes only the open `Select` and leaves the Drawer open. The `Select` now wires up its floating interaction props so it handles `Escape` itself, and the `Drawer` roots a floating tree so nested floating elements are recognized as its children.
diff --git a/.changeset/fuzzy-lions-recompose.md b/.changeset/fuzzy-lions-recompose.md
deleted file mode 100644
index 732d982b6e2..00000000000
--- a/.changeset/fuzzy-lions-recompose.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@clerk/expo': patch
----
-
-Fix Android native UI components crashing before window attachment or becoming unresponsive after navigation detaches and reattaches their views.
diff --git a/.changeset/open-buckets-bake.md b/.changeset/open-buckets-bake.md
deleted file mode 100644
index 8a627bfb70e..00000000000
--- a/.changeset/open-buckets-bake.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@clerk/tanstack-react-start': patch
-'@clerk/shared': patch
-'@clerk/astro': patch
----
-
-Escape `<`, `>`, and `/` when serializing the Clerk auth state into SSR `` sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client.
diff --git a/.changeset/select-floating-ui-keyboard.md b/.changeset/select-floating-ui-keyboard.md
deleted file mode 100644
index acdb5e17588..00000000000
--- a/.changeset/select-floating-ui-keyboard.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@clerk/ui': patch
----
-
-Improve `Select` keyboard and screen reader support by routing navigation through floating-ui's interaction hooks. Pressing `ArrowUp`/`ArrowDown` on a focused, closed `Select` now opens the listbox, and the active option is announced via `aria-activedescendant`. The searchable variant (for example the `PhoneInput` country picker) now exposes a proper combobox: its input is marked `role="combobox"` with `aria-controls`, `aria-autocomplete="list"`, and `aria-activedescendant`, while the plain variant keeps its listbox semantics.
diff --git a/.changeset/shiny-words-lay.md b/.changeset/shiny-words-lay.md
deleted file mode 100644
index bdec0a72915..00000000000
--- a/.changeset/shiny-words-lay.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@clerk/backend': patch
----
-
-Reject machine tokens (M2M and OAuth JWTs) presented in the `__session` cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as `userId`, defeating `if (userId)` authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens.
diff --git a/.changeset/tidy-expo-retries.md b/.changeset/tidy-expo-retries.md
deleted file mode 100644
index 30ab75705b9..00000000000
--- a/.changeset/tidy-expo-retries.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@clerk/expo': patch
----
-
-Prevent Expo apps from accumulating duplicate initialization requests while the Clerk API is unavailable or the app reloads.
diff --git a/packages/astro/CHANGELOG.md b/packages/astro/CHANGELOG.md
index 3a7f594a61a..b33b02108b2 100644
--- a/packages/astro/CHANGELOG.md
+++ b/packages/astro/CHANGELOG.md
@@ -1,5 +1,17 @@
# @clerk/astro
+## 3.4.19
+
+### Patch Changes
+
+- Fix Astro initialization when bundled `ui` or `prefetchUI: false` is passed to the integration. ([#8628](https://github.com/clerk/javascript/pull/8628)) by [@jescalan](https://github.com/jescalan)
+
+- Escape `<`, `>`, and `/` when serializing the Clerk auth state into SSR `` sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. ([#9166](https://github.com/clerk/javascript/pull/9166)) by [@dominic-clerk](https://github.com/dominic-clerk)
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+
## 3.4.18
### Patch Changes
diff --git a/packages/astro/package.json b/packages/astro/package.json
index 74a19b1342e..4fb782bcf53 100644
--- a/packages/astro/package.json
+++ b/packages/astro/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/astro",
- "version": "3.4.18",
+ "version": "3.4.19",
"description": "Clerk SDK for Astro",
"keywords": [
"auth",
diff --git a/packages/backend/CHANGELOG.md b/packages/backend/CHANGELOG.md
index a36a7fedebb..0e0e1b687b5 100644
--- a/packages/backend/CHANGELOG.md
+++ b/packages/backend/CHANGELOG.md
@@ -1,5 +1,14 @@
# Change Log
+## 3.11.7
+
+### Patch Changes
+
+- Reject machine tokens (M2M and OAuth JWTs) presented in the `__session` cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as `userId`, defeating `if (userId)` authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens. ([#9168](https://github.com/clerk/javascript/pull/9168)) by [@dominic-clerk](https://github.com/dominic-clerk)
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 3.11.6
### Patch Changes
diff --git a/packages/backend/package.json b/packages/backend/package.json
index c4b4ff14908..bfa7e45c9ef 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/backend",
- "version": "3.11.6",
+ "version": "3.11.7",
"description": "Clerk Backend SDK - REST Client for Backend API & JWT verification utilities",
"homepage": "https://clerk.com/",
"bugs": {
diff --git a/packages/chrome-extension/CHANGELOG.md b/packages/chrome-extension/CHANGELOG.md
index 4b6b4e7f00c..7daa3e96ba3 100644
--- a/packages/chrome-extension/CHANGELOG.md
+++ b/packages/chrome-extension/CHANGELOG.md
@@ -1,5 +1,15 @@
# Change Log
+## 3.1.54
+
+### Patch Changes
+
+- Updated dependencies [[`2632d88`](https://github.com/clerk/javascript/commit/2632d8894cc9e3e1a9f8fb4f56bebe2715e25c0a), [`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`b0ed361`](https://github.com/clerk/javascript/commit/b0ed36112d000ae4d7f46ae2d152fe7c0cce80a9)]:
+ - @clerk/ui@1.25.5
+ - @clerk/shared@4.25.5
+ - @clerk/react@6.12.5
+ - @clerk/clerk-js@6.25.5
+
## 3.1.53
### Patch Changes
diff --git a/packages/chrome-extension/package.json b/packages/chrome-extension/package.json
index 0154424ec28..e43cbf0c9c9 100644
--- a/packages/chrome-extension/package.json
+++ b/packages/chrome-extension/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/chrome-extension",
- "version": "3.1.53",
+ "version": "3.1.54",
"description": "Clerk SDK for Chrome extensions",
"keywords": [
"auth",
diff --git a/packages/clerk-js/CHANGELOG.md b/packages/clerk-js/CHANGELOG.md
index 799425a143d..0013c136cde 100644
--- a/packages/clerk-js/CHANGELOG.md
+++ b/packages/clerk-js/CHANGELOG.md
@@ -1,5 +1,12 @@
# Change Log
+## 6.25.5
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 6.25.4
### Patch Changes
diff --git a/packages/clerk-js/package.json b/packages/clerk-js/package.json
index 9dcc868b02c..fe1195e9f1f 100644
--- a/packages/clerk-js/package.json
+++ b/packages/clerk-js/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/clerk-js",
- "version": "6.25.4",
+ "version": "6.25.5",
"description": "Clerk JS library",
"keywords": [
"clerk",
diff --git a/packages/electron/CHANGELOG.md b/packages/electron/CHANGELOG.md
index 51abc85263c..d1ebd2a3d66 100644
--- a/packages/electron/CHANGELOG.md
+++ b/packages/electron/CHANGELOG.md
@@ -1,5 +1,14 @@
# @clerk/electron
+## 0.0.15
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+ - @clerk/react@6.12.5
+ - @clerk/clerk-js@6.25.5
+
## 0.0.14
### Patch Changes
diff --git a/packages/electron/package.json b/packages/electron/package.json
index bdba49ab127..df0b70a7a41 100644
--- a/packages/electron/package.json
+++ b/packages/electron/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/electron",
- "version": "0.0.14",
+ "version": "0.0.15",
"description": "Clerk SDK for Electron",
"keywords": [
"clerk",
diff --git a/packages/expo-passkeys/CHANGELOG.md b/packages/expo-passkeys/CHANGELOG.md
index 0a32aeb6bf8..956041b42c5 100644
--- a/packages/expo-passkeys/CHANGELOG.md
+++ b/packages/expo-passkeys/CHANGELOG.md
@@ -1,5 +1,12 @@
# @clerk/expo-passkeys
+## 1.2.6
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 1.2.5
### Patch Changes
diff --git a/packages/expo-passkeys/package.json b/packages/expo-passkeys/package.json
index d51ec269f62..5ed16e0ba44 100644
--- a/packages/expo-passkeys/package.json
+++ b/packages/expo-passkeys/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/expo-passkeys",
- "version": "1.2.5",
+ "version": "1.2.6",
"description": "Passkeys library to be used with Clerk for expo",
"keywords": [
"react-native",
diff --git a/packages/expo/CHANGELOG.md b/packages/expo/CHANGELOG.md
index 99eaf5e1ab9..2859d6cc79f 100644
--- a/packages/expo/CHANGELOG.md
+++ b/packages/expo/CHANGELOG.md
@@ -1,5 +1,18 @@
# Change Log
+## 3.7.7
+
+### Patch Changes
+
+- Fix Android native UI components crashing before window attachment or becoming unresponsive after navigation detaches and reattaches their views. ([#9178](https://github.com/clerk/javascript/pull/9178)) by [@wobsoriano](https://github.com/wobsoriano)
+
+- Prevent Expo apps from accumulating duplicate initialization requests while the Clerk API is unavailable or the app reloads. ([#9173](https://github.com/clerk/javascript/pull/9173)) by [@mikepitre](https://github.com/mikepitre)
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+ - @clerk/react@6.12.5
+ - @clerk/clerk-js@6.25.5
+
## 3.7.6
### Patch Changes
diff --git a/packages/expo/package.json b/packages/expo/package.json
index 61906183b1d..310b469387e 100644
--- a/packages/expo/package.json
+++ b/packages/expo/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/expo",
- "version": "3.7.6",
+ "version": "3.7.7",
"description": "Clerk React Native/Expo library",
"keywords": [
"react",
diff --git a/packages/express/CHANGELOG.md b/packages/express/CHANGELOG.md
index 316035c4a55..7e4c1a8881d 100644
--- a/packages/express/CHANGELOG.md
+++ b/packages/express/CHANGELOG.md
@@ -1,5 +1,13 @@
# Change Log
+## 2.1.43
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+
## 2.1.42
### Patch Changes
diff --git a/packages/express/package.json b/packages/express/package.json
index 4084924f1b4..126c0cd68a8 100644
--- a/packages/express/package.json
+++ b/packages/express/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/express",
- "version": "2.1.42",
+ "version": "2.1.43",
"description": "Clerk server SDK for usage with Express",
"keywords": [
"clerk",
diff --git a/packages/fastify/CHANGELOG.md b/packages/fastify/CHANGELOG.md
index 56b52ef730f..1d8ec504e23 100644
--- a/packages/fastify/CHANGELOG.md
+++ b/packages/fastify/CHANGELOG.md
@@ -1,5 +1,13 @@
# Change Log
+## 3.1.53
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+
## 3.1.52
### Patch Changes
diff --git a/packages/fastify/package.json b/packages/fastify/package.json
index 56ad8e39fe6..73e2f92e5d2 100644
--- a/packages/fastify/package.json
+++ b/packages/fastify/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/fastify",
- "version": "3.1.52",
+ "version": "3.1.53",
"description": "Clerk SDK for Fastify",
"keywords": [
"auth",
diff --git a/packages/headless/CHANGELOG.md b/packages/headless/CHANGELOG.md
index 1d9146df890..7e90a9c0657 100644
--- a/packages/headless/CHANGELOG.md
+++ b/packages/headless/CHANGELOG.md
@@ -1,5 +1,12 @@
# @clerk/headless
+## 0.0.13
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 0.0.12
### Patch Changes
diff --git a/packages/headless/package.json b/packages/headless/package.json
index a8b22371972..1e974d07876 100644
--- a/packages/headless/package.json
+++ b/packages/headless/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/headless",
- "version": "0.0.12",
+ "version": "0.0.13",
"private": true,
"sideEffects": false,
"type": "module",
diff --git a/packages/hono/CHANGELOG.md b/packages/hono/CHANGELOG.md
index 254d055af0a..a26af721798 100644
--- a/packages/hono/CHANGELOG.md
+++ b/packages/hono/CHANGELOG.md
@@ -1,5 +1,13 @@
# @clerk/hono
+## 0.1.53
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+
## 0.1.52
### Patch Changes
diff --git a/packages/hono/package.json b/packages/hono/package.json
index 14e54aef3c7..7bee74d38a1 100644
--- a/packages/hono/package.json
+++ b/packages/hono/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/hono",
- "version": "0.1.52",
+ "version": "0.1.53",
"description": "Clerk SDK for Hono",
"keywords": [
"auth",
diff --git a/packages/localizations/CHANGELOG.md b/packages/localizations/CHANGELOG.md
index 098312e2dfc..a74bb35054e 100644
--- a/packages/localizations/CHANGELOG.md
+++ b/packages/localizations/CHANGELOG.md
@@ -1,5 +1,12 @@
# Change Log
+## 4.13.5
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 4.13.4
### Patch Changes
diff --git a/packages/localizations/package.json b/packages/localizations/package.json
index 20508963f9e..237833d6520 100644
--- a/packages/localizations/package.json
+++ b/packages/localizations/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/localizations",
- "version": "4.13.4",
+ "version": "4.13.5",
"description": "Localizations for the Clerk components",
"keywords": [
"react",
diff --git a/packages/msw/CHANGELOG.md b/packages/msw/CHANGELOG.md
index 6563fcf7d12..d3b080e9cb3 100644
--- a/packages/msw/CHANGELOG.md
+++ b/packages/msw/CHANGELOG.md
@@ -1,5 +1,12 @@
# @clerk/msw
+## 0.0.49
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 0.0.48
### Patch Changes
diff --git a/packages/msw/package.json b/packages/msw/package.json
index a0d0fcbdeb8..f380bbd4018 100644
--- a/packages/msw/package.json
+++ b/packages/msw/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/msw",
- "version": "0.0.48",
+ "version": "0.0.49",
"private": true,
"sideEffects": false,
"type": "module",
diff --git a/packages/nextjs/CHANGELOG.md b/packages/nextjs/CHANGELOG.md
index 6ce3e3be397..edecac85e80 100644
--- a/packages/nextjs/CHANGELOG.md
+++ b/packages/nextjs/CHANGELOG.md
@@ -1,5 +1,14 @@
# Change Log
+## 7.5.20
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+ - @clerk/react@6.12.5
+
## 7.5.19
### Patch Changes
diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
index 5f1f273ea4c..8b952016ed5 100644
--- a/packages/nextjs/package.json
+++ b/packages/nextjs/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/nextjs",
- "version": "7.5.19",
+ "version": "7.5.20",
"description": "Clerk SDK for NextJS",
"keywords": [
"clerk",
diff --git a/packages/nuxt/CHANGELOG.md b/packages/nuxt/CHANGELOG.md
index 67eb5389ada..acb235d75cb 100644
--- a/packages/nuxt/CHANGELOG.md
+++ b/packages/nuxt/CHANGELOG.md
@@ -1,5 +1,14 @@
# @clerk/nuxt
+## 2.6.19
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+ - @clerk/vue@2.4.17
+
## 2.6.18
### Patch Changes
diff --git a/packages/nuxt/package.json b/packages/nuxt/package.json
index f6dbafd38ee..4252cd5958d 100644
--- a/packages/nuxt/package.json
+++ b/packages/nuxt/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/nuxt",
- "version": "2.6.18",
+ "version": "2.6.19",
"description": "Clerk SDK for Nuxt",
"keywords": [
"clerk",
diff --git a/packages/react-router/CHANGELOG.md b/packages/react-router/CHANGELOG.md
index 6c2cd3bc67a..f1a09032ad9 100644
--- a/packages/react-router/CHANGELOG.md
+++ b/packages/react-router/CHANGELOG.md
@@ -1,5 +1,14 @@
# Change Log
+## 3.5.12
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+ - @clerk/react@6.12.5
+
## 3.5.11
### Patch Changes
diff --git a/packages/react-router/package.json b/packages/react-router/package.json
index 5e214157925..0f670f28a52 100644
--- a/packages/react-router/package.json
+++ b/packages/react-router/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/react-router",
- "version": "3.5.11",
+ "version": "3.5.12",
"description": "Clerk SDK for React Router",
"keywords": [
"clerk",
diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
index 9fbc8bbda61..60ad706994b 100644
--- a/packages/react/CHANGELOG.md
+++ b/packages/react/CHANGELOG.md
@@ -1,5 +1,12 @@
# Change Log
+## 6.12.5
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 6.12.4
### Patch Changes
diff --git a/packages/react/package.json b/packages/react/package.json
index c4b2a0e5696..dda2a71c2ad 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/react",
- "version": "6.12.4",
+ "version": "6.12.5",
"description": "Clerk React library",
"keywords": [
"clerk",
diff --git a/packages/shared/CHANGELOG.md b/packages/shared/CHANGELOG.md
index 0efac6358ee..abbd1468fc5 100644
--- a/packages/shared/CHANGELOG.md
+++ b/packages/shared/CHANGELOG.md
@@ -1,5 +1,11 @@
# Change Log
+## 4.25.5
+
+### Patch Changes
+
+- Escape `<`, `>`, and `/` when serializing the Clerk auth state into SSR `` sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. ([#9166](https://github.com/clerk/javascript/pull/9166)) by [@dominic-clerk](https://github.com/dominic-clerk)
+
## 4.25.4
### Patch Changes
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 67ad24d3d5d..878fa398b39 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/shared",
- "version": "4.25.4",
+ "version": "4.25.5",
"description": "Internal package utils used by the Clerk SDKs",
"repository": {
"type": "git",
diff --git a/packages/swingset/CHANGELOG.md b/packages/swingset/CHANGELOG.md
index 16a00af644d..5439e0c01e1 100644
--- a/packages/swingset/CHANGELOG.md
+++ b/packages/swingset/CHANGELOG.md
@@ -1,5 +1,13 @@
# @clerk/swingset
+## 0.0.20
+
+### Patch Changes
+
+- Updated dependencies [[`2632d88`](https://github.com/clerk/javascript/commit/2632d8894cc9e3e1a9f8fb4f56bebe2715e25c0a), [`b0ed361`](https://github.com/clerk/javascript/commit/b0ed36112d000ae4d7f46ae2d152fe7c0cce80a9)]:
+ - @clerk/ui@1.25.5
+ - @clerk/headless@0.0.13
+
## 0.0.19
### Patch Changes
diff --git a/packages/swingset/package.json b/packages/swingset/package.json
index abf119b6205..80414dc600a 100644
--- a/packages/swingset/package.json
+++ b/packages/swingset/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/swingset",
- "version": "0.0.19",
+ "version": "0.0.20",
"private": true,
"type": "module",
"scripts": {
diff --git a/packages/tanstack-react-start/CHANGELOG.md b/packages/tanstack-react-start/CHANGELOG.md
index 3a7946d289b..fd39e46d685 100644
--- a/packages/tanstack-react-start/CHANGELOG.md
+++ b/packages/tanstack-react-start/CHANGELOG.md
@@ -1,5 +1,16 @@
# @clerk/tanstack-react-start
+## 1.4.20
+
+### Patch Changes
+
+- Escape `<`, `>`, and `/` when serializing the Clerk auth state into SSR `` sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. ([#9166](https://github.com/clerk/javascript/pull/9166)) by [@dominic-clerk](https://github.com/dominic-clerk)
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+ - @clerk/react@6.12.5
+
## 1.4.19
### Patch Changes
diff --git a/packages/tanstack-react-start/package.json b/packages/tanstack-react-start/package.json
index 16609e30597..aca3b8bf16c 100644
--- a/packages/tanstack-react-start/package.json
+++ b/packages/tanstack-react-start/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/tanstack-react-start",
- "version": "1.4.19",
+ "version": "1.4.20",
"description": "Clerk SDK for TanStack React Start",
"keywords": [
"clerk",
diff --git a/packages/testing/CHANGELOG.md b/packages/testing/CHANGELOG.md
index f6c586e09a4..6d762031d98 100644
--- a/packages/testing/CHANGELOG.md
+++ b/packages/testing/CHANGELOG.md
@@ -1,5 +1,13 @@
# @clerk/testing
+## 2.2.10
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716), [`e657d99`](https://github.com/clerk/javascript/commit/e657d994d938194cfa02da329707bf012873c01b)]:
+ - @clerk/shared@4.25.5
+ - @clerk/backend@3.11.7
+
## 2.2.9
### Patch Changes
diff --git a/packages/testing/package.json b/packages/testing/package.json
index 70893ce64c5..4fe05766dad 100644
--- a/packages/testing/package.json
+++ b/packages/testing/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/testing",
- "version": "2.2.9",
+ "version": "2.2.10",
"description": "Utilities to help you create E2E test suites for apps using Clerk",
"keywords": [
"auth",
diff --git a/packages/ui/CHANGELOG.md b/packages/ui/CHANGELOG.md
index f1801e8cbee..e06ce0b4fcb 100644
--- a/packages/ui/CHANGELOG.md
+++ b/packages/ui/CHANGELOG.md
@@ -1,5 +1,17 @@
# @clerk/ui
+## 1.25.5
+
+### Patch Changes
+
+- Fix pressing `Escape` while a `Select` is open inside a `Drawer` (for example the payment method picker in Checkout) dismissing the entire Drawer. `Escape` now closes only the open `Select` and leaves the Drawer open. The `Select` now wires up its floating interaction props so it handles `Escape` itself, and the `Drawer` roots a floating tree so nested floating elements are recognized as its children. ([#9176](https://github.com/clerk/javascript/pull/9176)) by [@alexcarpenter](https://github.com/alexcarpenter)
+
+- Improve `Select` keyboard and screen reader support by routing navigation through floating-ui's interaction hooks. Pressing `ArrowUp`/`ArrowDown` on a focused, closed `Select` now opens the listbox, and the active option is announced via `aria-activedescendant`. The searchable variant (for example the `PhoneInput` country picker) now exposes a proper combobox: its input is marked `role="combobox"` with `aria-controls`, `aria-autocomplete="list"`, and `aria-activedescendant`, while the plain variant keeps its listbox semantics. ([#9179](https://github.com/clerk/javascript/pull/9179)) by [@alexcarpenter](https://github.com/alexcarpenter)
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+ - @clerk/localizations@4.13.5
+
## 1.25.4
### Patch Changes
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 1c76963e880..348c1a0f3de 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/ui",
- "version": "1.25.4",
+ "version": "1.25.5",
"description": "Internal package that contains the UI components for the Clerk frontend SDKs",
"repository": {
"type": "git",
diff --git a/packages/vue/CHANGELOG.md b/packages/vue/CHANGELOG.md
index 09c10089a29..758660b72ea 100644
--- a/packages/vue/CHANGELOG.md
+++ b/packages/vue/CHANGELOG.md
@@ -1,5 +1,12 @@
# @clerk/vue
+## 2.4.17
+
+### Patch Changes
+
+- Updated dependencies [[`bcbdda6`](https://github.com/clerk/javascript/commit/bcbdda6d7d6c6e12cf33febe17fd148c69788716)]:
+ - @clerk/shared@4.25.5
+
## 2.4.16
### Patch Changes
diff --git a/packages/vue/package.json b/packages/vue/package.json
index 2ad613f632a..6ea8b323d9a 100644
--- a/packages/vue/package.json
+++ b/packages/vue/package.json
@@ -1,6 +1,6 @@
{
"name": "@clerk/vue",
- "version": "2.4.16",
+ "version": "2.4.17",
"description": "Clerk SDK for Vue",
"keywords": [
"clerk",