Merge branch 'main' into theo/protect-check-sdk-support

Author: jacekradko

.changeset/aisec-8-constant-time-token-signature-compare.md

@@ -0,0 +1,5 @@
+---
+'@clerk/nextjs': patch
+---
+
+Use a constant-time comparison when validating the integrity signature on the middleware-to-origin auth header handoff (`assertTokenSignature`). The previous `!==` compare was timing-variable; the new helper is synchronous and runtime-agnostic so it works in both Node and Edge Runtime.

.changeset/auto-proxy-vercel-subdomains.md

@@ -0,0 +1,8 @@
+---
+'@clerk/shared': patch
+'@clerk/backend': patch
+'@clerk/clerk-js': patch
+'@clerk/nextjs': patch
+---
+
+Auto-proxy FAPI requests for `.vercel.app` subdomains. When deployed to a `.vercel.app` domain without explicit proxy or domain configuration, the SDK automatically routes Frontend API requests through `/__clerk` on the app's own origin. This enables Clerk production mode on Vercel deployments without manual proxy setup.

.changeset/expand-ca-es-localization.md

@@ -0,0 +1,5 @@
+---
+'@clerk/localizations': patch
+---
+
+Expand the Catalan (`ca-ES`) localization by filling in previously undefined translations across billing, checkout, subscription management, cancellation flows, and related UI strings.

.changeset/node24-clerk-request-signal.md

@@ -0,0 +1,11 @@
+---
+'@clerk/backend': patch
+'@clerk/react-router': patch
+'@clerk/tanstack-react-start': patch
+---
+
+Fix `Request` cloning and outbound `fetch` to omit cross-realm `AbortSignal`. Node 24's bundled undici tightened the `instanceof AbortSignal` check on `RequestInit.signal`, which broke:
+
+- Cloning framework-specific requests such as `NextRequest` in `@clerk/backend`'s `ClerkRequest`.
+- Subclassed `Request`s passed through `patchRequest` in `@clerk/react-router` and `@clerk/tanstack-react-start`.
+- Frontend API proxying in `@clerk/backend`'s `clerkFrontendApiProxy`, which forwarded the inbound request's signal to the upstream `fetch`. Abort propagation will be restored in a follow-up via an in-realm `AbortController` bridge.

.changeset/pin-path-matcher-contracts.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/young-donkeys-sip.md

@@ -0,0 +1,2 @@
+---
+---

.github/actions/init-blacksmith/action.yml

@@ -4,7 +4,7 @@ inputs:
   node-version:
     description: 'The node version to use'
     required: false
-    default: '22'
+    default: '24.15.0'
   playwright-enabled:
     description: 'Enable Playwright?'
     required: false

.github/actions/init/action.yml

@@ -4,7 +4,7 @@ inputs:
   node-version:
     description: 'The node version to use'
     required: false
-    default: '22'
+    default: '24.15.0'
   playwright-enabled:
     description: 'Enable Playwright?'
     required: false

.github/workflows/ci.yml

@@ -218,7 +218,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - node-version: 22
+          - node-version: 24.15.0
+            test-filter: "**"
+            filter-label: "**"
+          - node-version: 20.19.0
             test-filter: "**"
             filter-label: "**"
 
@@ -257,7 +260,7 @@ jobs:
       - name: Run Typedoc tests
         run: |
           # Only run Typedoc tests for one matrix version and main test run
-          if [ "${{ matrix.node-version }}" == "22" ] && [ "${{ matrix.test-filter }}" = "**" ]; then
+          if [ "${{ matrix.node-version }}" == "24.15.0" ] && [ "${{ matrix.test-filter }}" = "**" ]; then
             pnpm turbo run //#test:typedoc
           fi
         env:
@@ -501,7 +504,7 @@ jobs:
         uses: ./.github/actions/init-blacksmith
         with:
           turbo-enabled: true
-          node-version: 22
+          node-version: 24.15.0
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
           turbo-summarize: ${{ env.TURBO_SUMMARIZE }}
           turbo-team: ${{ vars.TURBO_TEAM }}

.github/workflows/release.yml

@@ -524,7 +524,7 @@ jobs:
 
     strategy:
       matrix:
-        version: [22] # NOTE: 18 is cached in the main release workflow
+        version: [24] # NOTE: 20 is cached in the main release workflow
 
     steps:
       - name: Checkout Repo