Merge branch 'main' into alexbratsos/user-4373-signal-update-for-resource-and-fetchstatus-can-happen

Author: jacekradko

.changeset/fix-e2e-compromised-password.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/kind-peaches-notice.md

@@ -0,0 +1,16 @@
+---
+'@clerk/astro': minor
+'@clerk/nuxt': minor
+'@clerk/react-router': minor
+'@clerk/tanstack-react-start': minor
+'@clerk/shared': patch
+---
+
+Add an env-var shortcut for `unsafe_disableDevelopmentModeConsoleWarning` across the Astro, Nuxt, React Router, and TanStack Start integrations so the development-keys console warning can be suppressed without threading the option through `<ClerkProvider>` manually:
+
+- Astro: `PUBLIC_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING`
+- Nuxt: `NUXT_PUBLIC_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING`
+- React Router: `VITE_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING` (or `CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING`)
+- TanStack Start: `VITE_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING` (or `CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING`)
+
+The Next.js equivalent (`NEXT_PUBLIC_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING`) already existed; the JSDoc on `unsafe_disableDevelopmentModeConsoleWarning` now lists every framework's env-var shortcut and clarifies that suppressing the warning at source also keeps it from being mirrored to the dev-server terminal (e.g. Next.js with `experimental.browserDebugInfoInTerminal`).

.changeset/quiet-dev-keys-warning.md

@@ -17,7 +17,7 @@ Generate a commit message for changes in this chat. **Do not commit or push** (s
 
 Scopes must match package/app names. No scope is also valid. Invalid scope = commitlint rejection.
 
-- **Packages:** agent-toolkit, astro, backend, chrome-extension, clerk-js, dev-cli, elements, expo, expo-passkeys, express, fastify, localizations, nextjs, nuxt, react, react-router, remix, shared, tanstack-react-start, testing, themes, types, ui, upgrade, vue
+- **Packages:** astro, backend, chrome-extension, clerk-js, dev-cli, elements, expo, expo-passkeys, express, fastify, localizations, nextjs, nuxt, react, react-router, remix, shared, tanstack-react-start, testing, themes, types, ui, upgrade, vue
 - **Other:** docs, repo, release, e2e, \*
 
 ---

.cursor/commands/cmt.md

@@ -22,7 +22,6 @@ Core Package Categories
 - **Backend**: `@clerk/backend` - Server-side utilities and JWT verification
 - **Shared Utilities**: `@clerk/shared`, `@clerk/types` - Common utilities and TypeScript types
 - **Developer Tools**: `@clerk/testing`, `@clerk/dev-cli`, `@clerk/upgrade`
-- **Specialized**: `@clerk/agent-toolkit` - AI agent integration tools
 
 Directory Structure
 

.cursor/rules/monorepo.mdc

@@ -4,7 +4,7 @@ inputs:
   node-version:
     description: 'The node version to use'
     required: false
-    default: '22'
+    default: '24.15.0'
   playwright-enabled:
     description: 'Enable Playwright?'
     required: false
@@ -21,19 +21,15 @@ inputs:
     description: 'Cache usage settings'
     required: false
     default: 'remote:rw'
-  turbo-cache-dir:
-    description: 'The cache dir to use for Turbo'
-    required: false
-    default: './.turbo-cache'
   turbo-signature:
     description: 'The signature to use for Turbo'
     required: false
   turbo-team:
     description: 'The team to use for Turbo remote auth'
-    required: true
+    required: false
   turbo-token:
     description: 'The token to use for Turbo remote auth'
-    required: true
+    required: false
   registry-url:
     description: 'The registry the packages will be published to'
     required: false
@@ -52,7 +48,6 @@ runs:
       env:
         # envs are required to pass inputs to the script
         CACHE: ${{ inputs.turbo-cache }}
-        CACHE_DIR: ${{ inputs.turbo-cache-dir }}
         ENABLED: ${{ inputs.turbo-enabled }}
         SIGNATURE: ${{ inputs.turbo-signature }}
         SUMMARIZE: ${{ inputs.turbo-summarize }}
@@ -67,10 +62,9 @@ runs:
               ? os.availableParallelism()
               : os.cpus().length;
 
-          const { ENABLED, CACHE = 'remote:rw', CACHE_DIR, SIGNATURE, SUMMARIZE, TEAM, TOKEN, VERBOSE } = process.env
+          const { ENABLED, CACHE = 'remote:rw', SIGNATURE, SUMMARIZE, TEAM, TOKEN, VERBOSE } = process.env
 
           const ARGS = [
-            `--cache-dir=${CACHE_DIR}`,
             `--concurrency=${cpus}`,
             `--summarize=${SUMMARIZE}`,
           ]
@@ -88,15 +82,17 @@ runs:
           )
 
           if (ENABLED === 'true') {
-            if (!TEAM) {
-              throw new Error('turbo-team input is required and must not be empty')
-            }
-            if (!TOKEN) {
-              throw new Error('turbo-token input is required and must not be empty')
+            const missing = []
+            if (!TEAM) missing.push('turbo-team')
+            if (!TOKEN) missing.push('turbo-token')
+
+            if (missing.length > 0) {
+              core.warning(`Missing Turbo remote cache credentials: ${missing.join(', ')}. Turbo remote caching will be disabled.`)
+            } else {
+              core.exportVariable('TURBO_CACHE', CACHE)
+              core.exportVariable('TURBO_TEAM', TEAM)
+              core.exportVariable('TURBO_TOKEN', TOKEN)
             }
-            core.exportVariable('TURBO_CACHE', CACHE)
-            core.exportVariable('TURBO_TEAM', TEAM)
-            core.exportVariable('TURBO_TOKEN', TOKEN)
           }
 
           if (SIGNATURE && SIGNATURE !== '') {

.github/actions/init-blacksmith/action.yml

@@ -4,7 +4,7 @@ inputs:
   node-version:
     description: 'The node version to use'
     required: false
-    default: '22'
+    default: '24.15.0'
   playwright-enabled:
     description: 'Enable Playwright?'
     required: false
@@ -21,19 +21,15 @@ inputs:
     description: 'Cache usage settings'
     required: false
     default: 'remote:rw'
-  turbo-cache-dir:
-    description: 'The cache dir to use for Turbo'
-    required: false
-    default: './.turbo-cache'
   turbo-signature:
     description: 'The signature to use for Turbo'
     required: false
   turbo-team:
     description: 'The team to use for Turbo remote auth'
-    required: true
+    required: false
   turbo-token:
     description: 'The token to use for Turbo remote auth'
-    required: true
+    required: false
   registry-url:
     description: 'The registry the packages will be published to'
     required: false
@@ -52,7 +48,6 @@ runs:
       env:
         # envs are required to pass inputs to the script
         CACHE: ${{ inputs.turbo-cache }}
-        CACHE_DIR: ${{ inputs.turbo-cache-dir }}
         ENABLED: ${{ inputs.turbo-enabled }}
         SIGNATURE: ${{ inputs.turbo-signature }}
         SUMMARIZE: ${{ inputs.turbo-summarize }}
@@ -67,10 +62,9 @@ runs:
               ? os.availableParallelism()
               : os.cpus().length;
 
-          const { ENABLED, CACHE = 'remote:rw', CACHE_DIR, SIGNATURE, SUMMARIZE, TEAM, TOKEN, VERBOSE } = process.env
+          const { ENABLED, CACHE = 'remote:rw', SIGNATURE, SUMMARIZE, TEAM, TOKEN, VERBOSE } = process.env
 
           const ARGS = [
-            `--cache-dir=${CACHE_DIR}`,
             `--concurrency=${cpus}`,
             `--summarize=${SUMMARIZE}`,
           ]
@@ -88,15 +82,17 @@ runs:
           )
 
           if (ENABLED === 'true') {
-            if (!TEAM) {
-              throw new Error('turbo-team input is required and must not be empty')
-            }
-            if (!TOKEN) {
-              throw new Error('turbo-token input is required and must not be empty')
+            const missing = []
+            if (!TEAM) missing.push('turbo-team')
+            if (!TOKEN) missing.push('turbo-token')
+
+            if (missing.length > 0) {
+              core.warning(`Missing Turbo remote cache credentials: ${missing.join(', ')}. Turbo remote caching will be disabled.`)
+            } else {
+              core.exportVariable('TURBO_CACHE', CACHE)
+              core.exportVariable('TURBO_TEAM', TEAM)
+              core.exportVariable('TURBO_TOKEN', TOKEN)
             }
-            core.exportVariable('TURBO_CACHE', CACHE)
-            core.exportVariable('TURBO_TEAM', TEAM)
-            core.exportVariable('TURBO_TOKEN', TOKEN)
           }
 
           if (SIGNATURE && SIGNATURE !== '') {

.github/actions/init/action.yml

@@ -92,10 +92,6 @@ integration:
   - changed-files:
       - any-glob-to-any-file: integration/**
 
-agent-toolkit:
-  - changed-files:
-      - any-glob-to-any-file: packages/agent-toolkit/**
-
 # Base branch labels
 core-2:
   - base-branch: '^release/core-2$'

.github/labeler.yml

@@ -218,7 +218,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - node-version: 22
+          - node-version: 24.15.0
+            test-filter: "**"
+            filter-label: "**"
+          - node-version: 20.19.0
             test-filter: "**"
             filter-label: "**"
 
@@ -257,7 +260,7 @@ jobs:
       - name: Run Typedoc tests
         run: |
           # Only run Typedoc tests for one matrix version and main test run
-          if [ "${{ matrix.node-version }}" == "22" ] && [ "${{ matrix.test-filter }}" = "**" ]; then
+          if [ "${{ matrix.node-version }}" == "24.15.0" ] && [ "${{ matrix.test-filter }}" = "**" ]; then
             pnpm turbo run //#test:typedoc
           fi
         env:
@@ -274,7 +277,9 @@ jobs:
 
   integration-tests:
     needs: [check-permissions, build-packages]
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    if: >-
+      ${{ (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
+      && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
     name: Integration Tests (${{ matrix.test-name }}, ${{ matrix.test-project }}${{ matrix.next-version && format(', {0}', matrix.next-version) || '' }})
     permissions:
       contents: read
@@ -292,6 +297,7 @@ jobs:
           [
             "generic",
             "express",
+            "fastify",
             "ap-flows",
             "localhost",
             "sessions",
@@ -305,6 +311,7 @@ jobs:
             "react-router",
             "custom",
             "hono",
+            "chrome-extension",
           ]
         test-project: ["chrome"]
         include:
@@ -355,8 +362,7 @@ jobs:
           fi
           jq --version
 
-      - name: Task Status
-        id: task-status
+      - name: Validate turbo task
         env:
           E2E_APP_CLERK_JS_DIR: ${{runner.temp}}
           E2E_APP_CLERK_UI_DIR: ${{runner.temp}}
@@ -366,40 +372,48 @@ jobs:
           E2E_PROJECT: ${{ matrix.test-project }}
           INTEGRATION_INSTANCE_KEYS: ${{ secrets.INTEGRATION_INSTANCE_KEYS }}
         run: |
-          # Use turbo's built-in --affected flag to detect changes
-          # This automatically uses GITHUB_BASE_REF in GitHub Actions
-          TASK_COUNT=$(pnpm turbo run test:integration:${{ matrix.test-name }} --affected --dry=json 2>/dev/null | jq '.tasks | length' 2>/dev/null || echo "0")
+          # Validate the turbo task exists. Turbo's --affected flag is a no-op for
+          # root-level tasks (//#) — they are always returned as affected. The previous
+          # --affected check only served to silently skip tests when the task was missing
+          # from turbo.json, hiding real configuration errors.
+          TASK_NAME="test:integration:${{ matrix.test-name }}"
+          TURBO_STDERR=$(mktemp)
+          if ! TURBO_JSON=$(pnpm turbo run "$TASK_NAME" --dry=json 2>"$TURBO_STDERR"); then
+            echo "::error::Turbo task '$TASK_NAME' failed validation"
+            cat "$TURBO_STDERR"
+            exit 1
+          fi
 
-          if [ "$TASK_COUNT" -gt 0 ]; then
-            AFFECTED=1
-          else
-            AFFECTED=0
+          if ! TASK_COUNT=$(jq -er '.tasks | length' <<< "$TURBO_JSON"); then
+            echo "::error::Turbo task '$TASK_NAME' returned invalid JSON or missing .tasks"
+            printf '%s\n' "$TURBO_JSON"
+            exit 1
           fi
 
-          echo "affected=${AFFECTED}"
-          echo "affected=${AFFECTED}" >> $GITHUB_OUTPUT
+          if [ "$TASK_COUNT" -eq 0 ]; then
+            echo "::error::Turbo task '$TASK_NAME' returned 0 tasks"
+            exit 1
+          fi
+
+          echo "Task '$TASK_NAME' validated ($TASK_COUNT tasks in graph)"
 
       - name: Build packages
-        if: ${{ steps.task-status.outputs.affected == '1' }}
         run: pnpm turbo build $TURBO_ARGS --only
 
       - name: Publish to local registry
-        if: ${{ steps.task-status.outputs.affected == '1' }}
         run: pkglab pub --force
 
       - name: Edit .npmrc [link-workspace-packages=false]
         run: sed -i -E 's/link-workspace-packages=(deep|true)/link-workspace-packages=false/' .npmrc
 
       - name: Install @clerk/clerk-js in os temp
-        if: ${{ steps.task-status.outputs.affected == '1' }}
         working-directory: ${{runner.temp}}
         run: |
           mkdir clerk-js && cd clerk-js
           pnpm init
           pkglab add @clerk/clerk-js
 
       - name: Install @clerk/ui in os temp
-        if: ${{ steps.task-status.outputs.affected == '1' }}
         working-directory: ${{runner.temp}}
         run: |
           mkdir clerk-ui && cd clerk-ui
@@ -411,7 +425,6 @@ jobs:
         run: cd packages/astro && pnpm copy:components
 
       - name: Write all ENV certificates to files in integration/certs
-        if: ${{ steps.task-status.outputs.affected == '1' }}
         uses: actions/github-script@v7
         env:
           INTEGRATION_CERTS: "${{secrets.INTEGRATION_CERTS}}"
@@ -429,12 +442,10 @@ jobs:
             }
 
       - name: LS certs
-        if: ${{ steps.task-status.outputs.affected == '1' }}
         working-directory: ./integration/certs
         run: ls -la && pwd
 
       - name: Run Integration Tests
-        if: ${{ steps.task-status.outputs.affected == '1' }}
         id: integration-tests
         timeout-minutes: 25
         run: pnpm turbo test:integration:${{ matrix.test-name }} $TURBO_ARGS
@@ -451,12 +462,21 @@ jobs:
           NODE_EXTRA_CA_CERTS: ${{ github.workspace }}/integration/certs/rootCA.pem
           VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
 
+      - name: Sanitize artifact name
+        if: ${{ cancelled() || failure() }}
+        id: sanitize
+        run: |
+          SANITIZED="${TEST_NAME//:/-}"
+          echo "artifact-suffix=${SANITIZED}" >> $GITHUB_OUTPUT
+        env:
+          TEST_NAME: ${{ matrix.test-name }}
+
       - name: Upload test-results
         if: ${{ cancelled() || failure() }}
         uses: actions/upload-artifact@v4
         with:
-          name: playwright-traces-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.test-name }}${{ matrix.next-version && format('-next{0}', matrix.next-version) || '' }}
-          path: integration/test-results
+          name: playwright-traces-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.sanitize.outputs.artifact-suffix }}${{ matrix.next-version && format('-next{0}', matrix.next-version) || '' }}
+          path: test-results
           retention-days: 1
 
   pkg-pr-new:
@@ -484,7 +504,7 @@ jobs:
         uses: ./.github/actions/init-blacksmith
         with:
           turbo-enabled: true
-          node-version: 22
+          node-version: 24.15.0
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
           turbo-summarize: ${{ env.TURBO_SUMMARIZE }}
           turbo-team: ${{ vars.TURBO_TEAM }}

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     # run every 6 hours on every weekday
     - cron: '0 */6 * * 1-5'
 
+permissions:
+  contents: read
+
 jobs:
   integration-tests:
     name: Cleanup e2e instances
@@ -34,3 +37,4 @@ jobs:
         run: pnpm test:integration:cleanup
         env:
           INTEGRATION_INSTANCE_KEYS: ${{ secrets.INTEGRATION_INSTANCE_KEYS }}
+          INTEGRATION_STAGING_INSTANCE_KEYS: ${{ secrets.INTEGRATION_STAGING_INSTANCE_KEYS }}