[dependabot]

Bumps @clerk/backend from 3.22.0 to 3.26.2.

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.26.1

Patch Changes

• Stop accepting the legacy cl_I7d4PD111III JWT category as a session or handshake token. Clerk no longer issues it, so authenticateRequest() now returns a signed-out state with reason token-type-mismatch for a token carrying it, the same as for other non-session categories. (#10286) by @​dominic-clerk

@​clerk/backend@​3.26.0

Minor Changes

• Add webhook types for transactional email delivery, delays, bounces, complaints, failures, and suppressions. Bounce events distinguish Permanent, Transient, and Undetermined classifications. verifyWebhook() preserves the original event timestamp and instance ID for outcome handlers. These types prepare for the transactional email pilot; receiving the events requires the corresponding backend rollout. (#9776) by @​jescalan

Patch Changes

• Clarify issuer validation for session tokens and document that machine token verification ignores the issuer option. (#10282) by @​SarahSoutoul

• Updated dependencies [e5cfdff]:

  • @​clerk/shared@​4.41.0

Changelog

Sourced from @​clerk/backend's changelog.

3.26.2

Patch Changes

• Updated dependencies [8c3739d, 0334b05]:
  • @​clerk/shared@​4.41.1

3.26.1

Patch Changes

• Stop accepting the legacy cl_I7d4PD111III JWT category as a session or handshake token. Clerk no longer issues it, so authenticateRequest() now returns a signed-out state with reason token-type-mismatch for a token carrying it, the same as for other non-session categories. (#10286) by @​dominic-clerk

3.26.0

Minor Changes

• Add webhook types for transactional email delivery, delays, bounces, complaints, failures, and suppressions. Bounce events distinguish Permanent, Transient, and Undetermined classifications. verifyWebhook() preserves the original event timestamp and instance ID for outcome handlers. These types prepare for the transactional email pilot; receiving the events requires the corresponding backend rollout. (#9776) by @​jescalan

Patch Changes

• Clarify issuer validation for session tokens and document that machine token verification ignores the issuer option. (#10282) by @​SarahSoutoul

• Updated dependencies [e5cfdff]:

  • @​clerk/shared@​4.41.0

3.25.0

Minor Changes

• Added an optional issuer option to verifyJwt(), verifyToken(), and authenticateRequest() to validate the JWT iss claim against a string or list of allowed strings. For verifyToken() and authenticateRequest(), this applies only to session tokens. Omitting issuer preserves existing behavior. (#8772) by @​jacekradko

3.24.0

Minor Changes

• Add deprovisioned to the Backend User object and UserJSON, so you can tell when Directory Sync has deactivated a user, including in user.updated webhook payloads, without casting. It's separate from banned: Directory Sync sets and clears deprovisioned, while you set banned through the Dashboard or Backend API. (#10245) by @​manovotny

3.23.2

Patch Changes

• Updated dependencies [dcb03d3, 31c1930]:
  • @​clerk/shared@​4.40.0

3.23.1

Patch Changes

• Updated dependencies [568c668]:

... (truncated)

Commits

• 8b9403b ci(repo): Version packages (#10347)
• 0334b05 fix(clerk-js): preserve indefinite session deadlines (#9871)
• 80b0813 ci(repo): Version packages (#10315)
• 49c8afd fix(backend): stop accepting the legacy ignore JWT category as a session toke...
• ec91b9b ci(repo): Version packages (#10283)
• b799bad fix(backend): clarify issuer verification options (#10282)
• 85dec02 feat(backend): add transactional email outcome webhook types (#9776)
• 0c7e63b ci(repo): Version packages (#10274)
• 57aeba8 feat(backend): validate JWT issuer (iss) claim when an issuer option is provi...
• 01da4b4 ci(repo): Version packages (#10234)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dashboard-skillcheck	Ready	Preview	Oct 27, 2026 4:45pm UTC