Merge branch 'main' into renovate/npm-astro-vulnerability

Author: wobsoriano

.changeset/ci-ready-for-review.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/fix-native-session-sync-reload.md

@@ -0,0 +1,7 @@
+---
+'@clerk/expo': patch
+---
+
+Fix session loss on Expo JS reload (pressing R in dev)
+
+`NativeSessionSync` was calling native `signOut()` during the loading phase when `isSignedIn` is `undefined`. On a JS reload, the native module persists from the previous session, so `signOut()` revokes the session server-side and clears all keychain items, forcing the user to log in again. This adds an `isLoaded` guard so native `signOut()` is only called when Clerk has confirmed the user is actually signed out.

.changeset/invert-clerk-rq-ownership.md

@@ -0,0 +1,11 @@
+---
+'@clerk/shared': patch
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+---
+
+Move ownership of the clerk-rq `QueryClient` from `@clerk/clerk-js` into `@clerk/shared`. The `QueryObserver` (constructed in `@clerk/shared`) and the `Query` objects it observes now always come from a single `@tanstack/query-core` resolution — the cross-bundle API contract that produced #8428 (`Query.isFetched is not a function`) no longer exists.
+
+This removes the undocumented `clerk.__internal_queryClient` getter from both `@clerk/clerk-js` and `@clerk/react`'s `IsomorphicClerk`. The `QueryClient` is owned by an internal singleton in `@clerk/shared`, lazily instantiated on the browser only — server renders return `undefined`, preserving SSR safety and avoiding cross-request cache sharing.
+
+`@tanstack/query-core` is no longer a direct dependency of `@clerk/clerk-js`; it remains a dep of `@clerk/shared` and resolves consumer-side as before.

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI
 on:
   merge_group:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches:
       - main
       - release/v4

packages/clerk-js/bundlewatch.config.json

@@ -9,7 +9,6 @@
     { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
     { "path": "./dist/base-account-sdk*.js", "maxSize": "203KB" },
     { "path": "./dist/stripe-vendors*.js", "maxSize": "1KB" },
-    { "path": "./dist/query-core-vendors*.js", "maxSize": "11KB" },
     { "path": "./dist/zxcvbn-ts-core*.js", "maxSize": "12KB" },
     { "path": "./dist/zxcvbn-common*.js", "maxSize": "226KB" }
   ]

packages/clerk-js/package.json

@@ -91,7 +91,6 @@
     "@solana/wallet-standard": "catalog:module-manager",
     "@stripe/stripe-js": "5.6.0",
     "@swc/helpers": "catalog:repo",
-    "@tanstack/query-core": "catalog:repo",
     "@wallet-standard/core": "catalog:module-manager",
     "@zxcvbn-ts/core": "catalog:module-manager",
     "@zxcvbn-ts/language-common": "catalog:module-manager",

packages/clerk-js/rspack.config.js

@@ -110,12 +110,6 @@ const common = ({ mode, variant, disableRHC = false }) => {
             chunks: 'all',
             enforce: true,
           },
-          queryCoreVendor: {
-            test: /[\\/]node_modules[\\/](@tanstack\/query-core)[\\/]/,
-            name: 'query-core-vendors',
-            chunks: 'all',
-            enforce: true,
-          },
           defaultVendors: {
             minChunks: 1,
             test: module => {

packages/clerk-js/src/core/clerk.ts

@@ -138,7 +138,6 @@ import type {
 import type { ClerkUI } from '@clerk/shared/ui';
 import { addClerkPrefix, isAbsoluteUrl, stripScheme } from '@clerk/shared/url';
 import { allSettled, handleValueOrFn, noop } from '@clerk/shared/utils';
-import type { QueryClient } from '@tanstack/query-core';
 
 import { debugLogger, initDebugLogger } from '@/utils/debug';
 import { ModuleManager } from '@/utils/moduleManager';
@@ -248,7 +247,6 @@ export class Clerk implements ClerkInterface {
   // converted to protected environment to support `updateEnvironment` type assertion
   protected environment?: EnvironmentResource | null;
 
-  #queryClient: QueryClient | undefined;
   #publishableKey = '';
   #domain: DomainOrProxyUrl['domain'];
   #proxyUrl: DomainOrProxyUrl['proxyUrl'];
@@ -268,28 +266,6 @@ export class Clerk implements ClerkInterface {
   #touchThrottledUntil = 0;
   #publicEventBus = createClerkEventBus();
 
-  get __internal_queryClient(): { __tag: 'clerk-rq-client'; client: QueryClient } | undefined {
-    if (!this.#queryClient) {
-      void import('./query-core')
-        .then(module => module.QueryClient)
-        .then(QueryClient => {
-          if (this.#queryClient) {
-            return;
-          }
-          this.#queryClient = new QueryClient();
-          // @ts-expect-error - queryClientStatus is not typed
-          this.#publicEventBus.emit('queryClientStatus', 'ready');
-        });
-    }
-
-    return this.#queryClient
-      ? {
-          __tag: 'clerk-rq-client',
-          client: this.#queryClient,
-        }
-      : undefined;
-  }
-
   public __internal_getCachedResources:
     | (() => Promise<{ client: ClientJSONSnapshot | null; environment: EnvironmentJSONSnapshot | null }>)
     | undefined;

packages/clerk-js/src/core/query-core.ts

@@ -1,7 +1,7 @@
+import { __createClerkTestQueryClient } from '@clerk/shared/react';
 import type { ActiveSessionResource, LoadedClerk } from '@clerk/shared/types';
 import { type Mocked, vi } from 'vitest';
 
-import { QueryClient } from '../core/query-core';
 import type { RouteContextValue } from '../ui/router';
 
 type FunctionLike = (...args: any) => any;
@@ -46,19 +46,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepVitestMocked<LoadedCle
   // Cast clerk to any to allow mocking properties
   const clerkAny = clerk as any;
 
-  const defaultQueryClient = {
-    __tag: 'clerk-rq-client' as const,
-    client: new QueryClient({
-      defaultOptions: {
-        queries: {
-          retry: false,
-          // Setting staleTime to Infinity will not cause issues between tests as long as each test
-          // case has its own wrapper that initializes a Clerk instance with a new QueryClient.
-          staleTime: Infinity,
-        },
-      },
-    }),
-  };
+  __createClerkTestQueryClient();
 
   mockMethodsOf(clerkAny);
   if (clerkAny.client) {
@@ -92,12 +80,6 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepVitestMocked<LoadedCle
     mockMethodsOf(clerkAny.billing);
   }
 
-  // Mock the __internal_queryClient getter property
-  Object.defineProperty(clerkAny, '__internal_queryClient', {
-    get: vi.fn(() => defaultQueryClient),
-    configurable: true,
-  });
-
   mockProp(clerkAny, 'navigate');
   mockProp(clerkAny, 'setActive');
   mockProp(clerkAny, 'redirectWithAuth');