chore(deps): bump the clerk-dependencies group with 2 updates

[dependabot]

Bumps the clerk-dependencies group with 2 updates: @clerk/backend and @clerk/shared.

Updates @clerk/backend from 3.11.7 to 3.12.0

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.12.0

Minor Changes

• Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

• Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

• Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

• Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

  • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
  • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
  • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

• Updated dependencies [858a689, c904fb4]:

  • @​clerk/shared@​4.25.6

Changelog

Sourced from @​clerk/backend's changelog.

3.12.0

Minor Changes

• Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

• Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

• Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

• Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

  • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
  • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
  • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

• Updated dependencies [858a689, c904fb4]:

  • @​clerk/shared@​4.25.6

Commits

• 430ae23 ci(repo): Version packages (#9195)
• 858a689 docs(repo): Add trailing comma after e.g. and i.e. in JSDoc (#9201)
• a009d91 fix(backend): Align enterprise connection create and update params with the B...
• ff5d991 fix(backend): Fix cross-origin handshake bypass (#9145)
• 26530ce feat(backend): support organization-scoped sign-in tokens (#9192)
• See full diff in compare view

Updates @clerk/shared from 4.25.5 to 4.25.6

Release notes

Sourced from @​clerk/shared's releases.

@​clerk/shared@​4.25.6

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add an experimental oidcSelfServe option to enable the self-serve OIDC configuration flow in <ConfigureSSO />. (#9198) by @​NicolasLopes7

Changelog

Sourced from @​clerk/shared's changelog.

4.25.6

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add an experimental oidcSelfServe option to enable the self-serve OIDC configuration flow in <ConfigureSSO />. (#9198) by @​NicolasLopes7

Commits

• 430ae23 ci(repo): Version packages (#9195)
• 858a689 docs(repo): Add trailing comma after e.g. and i.e. in JSDoc (#9201)
• c904fb4 feat(ui): add experimental flag to gate the OIDC self-serve flow (#9198)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions