Skip to content

fix(chrome-extension): avoid remote loaders and initialize production auth - #10565

Draft
mwickett wants to merge 5 commits into
mainfrom
fix/chrome-extension-protect-loader
Draft

mwickett wants to merge 5 commits into
mainfrom
fix/chrome-extension-protect-loader

Conversation

@mwickett

@mwickett mwickett commented Oct 31, 2026 •

Copy link
Copy Markdown
Member

Description

@clerk/chrome-extension uses ClerkJS's no-RHC build, but that build could still insert Device Intelligence scripts supplied by the environment configuration. The no-RHC build now omits Device Intelligence loader initialization. Regular browser builds retain the configured loading behavior.

Production extension requests also declare native API mode from the first request, before a client credential is stored. Previously, only requests with a cached credential included that mode, preventing a fresh production extension from initializing authentication.

Build checks cover both ESM and CommonJS no-RHC outputs. Packaged-extension regressions exercise configured remote and inline script loaders with extension CSP enforced. The live auth suite covers development and production sign-in and sign-up without a Testing Token. It uses reserved verification addresses, creates disposable users, and removes its temporary production origin afterward. On the dedicated production fixture, email verification temporarily uses test mode and restores the original setting after the test.

The draft remains blocked on development sign-up: the live test receives an HTTP 403 response. Development sign-in and production sign-in/sign-up pass.

Checklist

  • Affected ClerkJS tests: 314 passed, 1 skipped, 4 todo.
  • Chrome extension unit tests: 63 passed; no type errors. The initial production request regression fails without the bootstrap fix.
  • pnpm turbo build --filter=@clerk/chrome-extension --concurrency=3 passes, including both no-RHC artifact checks.
  • Packaged Chromium regression: development and production configuration cases pass with a mocked API; both fail when the loader initialization guard is removed.
  • Template compilation, ESLint, Prettier, and changeset validation pass.
  • Live development sign-in and production sign-in/sign-up pass with extension CSP enforced and no Testing Token.
  • Live development sign-up passes. The latest extension CI job reports 10 passed and 1 failed; development sign-up is the sole failure.
  • (If applicable) JSDoc comments have been added or updated for package exports — no exported API changes.
  • (If applicable) Documentation has been updated — restores the existing no-RHC build contract.

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

@changeset-bot

changeset-bot Bot commented Oct 31, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 0baee80

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@clerk/clerk-js Patch
@clerk/chrome-extension Patch
@clerk/electron Patch
@clerk/expo Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercel Bot commented Oct 31, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clerk-js-sandbox Ready Ready Preview Oct 31, 2026 3:58pm UTC
swingset Ready Ready Preview Oct 31, 2026 3:58pm UTC

Request Review

@pkg-pr-new

pkg-pr-new Bot commented Oct 31, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10565

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10565

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10565

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10565

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10565

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10565

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10565

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10565

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10565

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10565

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10565

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10565

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10565

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10565

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10565

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10565

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10565

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10565

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10565

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10565

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10565

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10565

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10565

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10565

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10565

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10565

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10565

commit: 0baee80

@coderabbitai

coderabbitai Bot commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

@mwickett mwickett changed the title fix(js): omit Device Intelligence loaders from no-RHC builds fix(chrome-extension): avoid remote loaders and initialize production auth Oct 31, 2026

This branch was successfully deployed

2 active deployments
Preview – swingset — 0baee804 Deployed Oct 31, 2026 by vercel[bot]
Preview – clerk-js-sandbox — 0baee804 Deployed Oct 31, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant