Merge branch 'main' into rob/oauth-consent-ga

Author: wobsoriano

.changeset/auth-import-error.md

@@ -4,7 +4,7 @@ inputs:
   node-version:
     description: 'The node version to use'
     required: false
-    default: '22'
+    default: '24.15.0'
   playwright-enabled:
     description: 'Enable Playwright?'
     required: false

.changeset/bump-clerk-android-1.0.13.md

@@ -4,7 +4,7 @@ inputs:
   node-version:
     description: 'The node version to use'
     required: false
-    default: '22'
+    default: '24.15.0'
   playwright-enabled:
     description: 'Enable Playwright?'
     required: false

.changeset/oauth-consent-last-active-org.md

@@ -218,7 +218,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - node-version: 22
+          - node-version: 24.15.0
+            test-filter: "**"
+            filter-label: "**"
+          - node-version: 20.19.0
             test-filter: "**"
             filter-label: "**"
 
@@ -257,7 +260,7 @@ jobs:
       - name: Run Typedoc tests
         run: |
           # Only run Typedoc tests for one matrix version and main test run
-          if [ "${{ matrix.node-version }}" == "22" ] && [ "${{ matrix.test-filter }}" = "**" ]; then
+          if [ "${{ matrix.node-version }}" == "24.15.0" ] && [ "${{ matrix.test-filter }}" = "**" ]; then
             pnpm turbo run //#test:typedoc
           fi
         env:
@@ -501,7 +504,7 @@ jobs:
         uses: ./.github/actions/init-blacksmith
         with:
           turbo-enabled: true
-          node-version: 22
+          node-version: 24.15.0
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
           turbo-summarize: ${{ env.TURBO_SUMMARIZE }}
           turbo-team: ${{ vars.TURBO_TEAM }}

.changeset/wacky-dryers-hammer.md

@@ -524,7 +524,7 @@ jobs:
 
     strategy:
       matrix:
-        version: [22] # NOTE: 18 is cached in the main release workflow
+        version: [24] # NOTE: 20 is cached in the main release workflow
 
     steps:
       - name: Checkout Repo

.github/actions/init-blacksmith/action.yml

@@ -1 +1 @@
-22.11.0
+24.15.0

.github/actions/init/action.yml

@@ -0,0 +1,11 @@
+import { auth } from '@clerk/nextjs/server';
+
+// Regression guard for the "mixed auth params + options in a single argument"
+// bypass. When callers assign the argument to a variable (which defeats TS's
+// excess-property check), the role check must still run.
+const opts = { role: 'org:admin', unauthorizedUrl: '/settings/denied' } as const;
+
+export default async function Page() {
+  await auth.protect(opts);
+  return <p>User has access</p>;
+}