chore(deps): bump the production-minor-patch group across 1 directory with 2 updates

[dependabot]

Bumps the production-minor-patch group with 2 updates in the / directory: @clerk/backend and express-rate-limit.

Updates @clerk/backend from 3.8.2 to 3.13.1

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.13.1

Patch Changes

• Updated dependencies [01f2c12]:
  • @​clerk/shared@​4.25.8

@​clerk/backend@​3.13.0

Minor Changes

• Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

• Updated dependencies [097432d]:
  • @​clerk/shared@​4.25.7

@​clerk/backend@​3.12.0

Minor Changes

• Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

• Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

• Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

• Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

  • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
  • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
  • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

• Updated dependencies [858a689, c904fb4]:

  • @​clerk/shared@​4.25.6

@​clerk/backend@​3.11.7

Patch Changes

• Reject machine tokens (M2M and OAuth JWTs) presented in the __session cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as userId, defeating if (userId) authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens. (#9168) by @​dominic-clerk

• Updated dependencies [bcbdda6]:

  • @​clerk/shared@​4.25.5

Changelog

Sourced from @​clerk/backend's changelog.

3.13.1

Patch Changes

• Updated dependencies [01f2c12]:
  • @​clerk/shared@​4.25.8

3.13.0

Minor Changes

• Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

• Updated dependencies [097432d]:
  • @​clerk/shared@​4.25.7

3.12.0

Minor Changes

• Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

• Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

• Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

• Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

  • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
  • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
  • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

• Updated dependencies [858a689, c904fb4]:

  • @​clerk/shared@​4.25.6

3.11.7

Patch Changes

• Reject machine tokens (M2M and OAuth JWTs) presented in the __session cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as userId, defeating if (userId) authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens. (#9168) by @​dominic-clerk

• Updated dependencies [bcbdda6]:

  • @​clerk/shared@​4.25.5

... (truncated)

Commits

• 9081534 ci(repo): Version packages (#9240)
• acef8a1 ci(repo): Version packages (#9219)
• 848eefe feat(backend): support configurable Frontend API proxy URLs (#9223)
• 430ae23 ci(repo): Version packages (#9195)
• 858a689 docs(repo): Add trailing comma after e.g. and i.e. in JSDoc (#9201)
• a009d91 fix(backend): Align enterprise connection create and update params with the B...
• ff5d991 fix(backend): Fix cross-origin handshake bypass (#9145)
• 26530ce feat(backend): support organization-scoped sign-in tokens (#9192)
• b37ba0d ci(repo): Version packages (#9175)
• e657d99 fix(backend): reject machine JWTs presented as session tokens (#9168)
• Additional commits viewable in compare view

Updates express-rate-limit from 8.6.0 to 8.6.1

Release notes

Sourced from express-rate-limit's releases.

v8.6.1

You can view the changelog here.

Commits

• c7fced5 8.6.1
• b21110e chore: deprecate millisecond-based time constants (#662)
• fad3d85 chore(deps-dev): bump the development-dependencies group with 4 updates (#660)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dwcbackend	Error		Jul 27, 2026 5:19pm
dwcode	Ready	Preview, Comment	Jul 27, 2026 5:19pm

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.