chore(clerk-js): remove redundant dequal dependency by jacekradko · Pull Request #8608 · clerk/javascript

jacekradko · 2026-05-21T01:17:23Z

Nothing in @clerk/clerk-js imports dequal directly. It was listed as a direct runtime dependency but is only reached transitively through @clerk/shared (useDeepEqualMemo). Drop it from packages/clerk-js/package.json and the lockfile, with a patch changeset.

Resolves AISEC-32. Thanks to @7188ce06 for reporting.

vercel · 2026-05-21T01:17:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jun 3, 2026 5:31pm

changeset-bot · 2026-05-21T01:17:28Z

🦋 Changeset detected

Latest commit: 05a9257

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-05-21T01:29:10Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 18c77492-6b5e-4489-ba23-ec3457bbe0f4

📥 Commits

Reviewing files that changed from the base of the PR and between faa16d3 and 05a9257.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

packages/clerk-js/package.json

✅ Files skipped from review due to trivial changes (1)

packages/clerk-js/package.json

📝 Walkthrough

Walkthrough

This PR removes a redundant direct dequal dependency from the @clerk/clerk-js package by deleting it from package.json and adds a changeset documenting the removal and a patch version bump.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: removing the redundant dequal dependency from the clerk-js package. It is concise, specific, and directly relates to the changeset.
Description check	✅ Passed	The description is directly related to the changeset, explaining why dequal is redundant (only transitively needed through `@clerk/shared`) and references the issue being resolved.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-05-21T01:31:40Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8608

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8608

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8608

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8608

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8608

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8608

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8608

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8608

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8608

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8608

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8608

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8608

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8608

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8608

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8608

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8608

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8608

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8608

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8608

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8608

commit: 05a9257

wobsoriano · 2026-05-21T05:21:08Z

@jacekradko, this PR will use dequal 😃 #8587

(I already reviewed and approved the PR, but if you have bandwidth for a quick scan, Id appreciate it.)

…dundant-dequal-runtime

github-actions · 2026-05-27T20:04:46Z

Snapi: no API changes detected in @clerk/backend, @clerk/clerk-js, @clerk/nextjs, @clerk/react, @clerk/shared, @clerk/ui.

…dundant-dequal-runtime

github-actions · 2026-06-03T17:33:47Z

API Changes Report

Generated by Break Check on 2026-06-03T17:33:45.204Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

Note
Break Check could not snapshot 3 subpaths; the diff below excludes them.

@clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.

@clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.

@clerk/testing ./cypress: Symbol not found for identifier: Cypress

@clerk/shared

Current version: 4.15.0
Recommended bump: MINOR → 4.16.0

Subpath `./apiUrlFromPublishableKey`

🟡 Non-breaking Changes (1)

Modified: `apiUrlFromPublishableKey`

- apiUrlFromPublishableKey: (publishableKey: string) => "https://api.lclclerk.com" | "https://api.clerkstage.dev" | "https://api.clerk.com"
+ apiUrlFromPublishableKey: (publishableKey: string) => "https://api.clerk.com" | "https://api.lclclerk.com" | "https://api.clerkstage.dev"

Static analyzer: Breaking change in function apiUrlFromPublishableKey: Return type changed: "https://api.lclclerk.com"|"https://api.clerkstage.dev"|"https://api.clerk.com" → "https://api.clerk.com"|"https://api.lclclerk.com"|"https://api.clerkstage.dev"

🤖 AI review (reclassified as non-breaking) (99%): The union members are identical; only their order changed, and TypeScript union types are order-independent — no well-typed consumer code can break from this reordering.

Report generated by Break Check

_{Last ran on 05a9257. Pushes that change no tracked declarations (no API surface change vs. base) are skipped and don't update this comment.}

chore(clerk-js): remove redundant dequal dependency

da41d04

vercel Bot deployed to Preview May 21, 2026 01:17 View deployment

github-actions Bot added the clerk-js label May 21, 2026

jacekradko marked this pull request as ready for review May 21, 2026 01:28

alexcarpenter approved these changes May 21, 2026

View reviewed changes

alexcarpenter self-requested a review May 21, 2026 12:30

Merge branch 'main' into jacek/aisec-32-f-281-clerkclerk-js-remove-re…

faa16d3

…dundant-dequal-runtime

vercel Bot deployed to Preview May 27, 2026 20:03 View deployment

Merge branch 'main' into jacek/aisec-32-f-281-clerkclerk-js-remove-re…

05a9257

…dundant-dequal-runtime

vercel Bot deployed to Preview June 3, 2026 17:31 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(clerk-js): remove redundant dequal dependency#8608

chore(clerk-js): remove redundant dequal dependency#8608
jacekradko wants to merge 3 commits into
mainfrom
jacek/aisec-32-f-281-clerkclerk-js-remove-redundant-dequal-runtime

jacekradko commented May 21, 2026 •

edited

Loading

Uh oh!

vercel Bot commented May 21, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented May 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 21, 2026 •

edited

Loading

Walkthrough

Estimated code review effort

Uh oh!

pkg-pr-new Bot commented May 21, 2026 •

edited

Loading

Uh oh!

wobsoriano commented May 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

github-actions Bot commented Jun 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jacekradko commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Uh oh!

pkg-pr-new Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wobsoriano commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

github-actions Bot commented Jun 3, 2026

API Changes Report

Summary

@clerk/shared

Subpath ./apiUrlFromPublishableKey

🟡 Non-breaking Changes (1)

Modified: apiUrlFromPublishableKey

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jacekradko commented May 21, 2026 •

edited

Loading

vercel Bot commented May 21, 2026 •

edited

Loading

changeset-bot Bot commented May 21, 2026 •

edited

Loading

coderabbitai Bot commented May 21, 2026 •

edited

Loading

pkg-pr-new Bot commented May 21, 2026 •

edited

Loading

wobsoriano commented May 21, 2026 •

edited

Loading

Subpath `./apiUrlFromPublishableKey`

Modified: `apiUrlFromPublishableKey`