chore(repo): Move tslib to devDependencies by dominic-clerk · Pull Request #10521 · clerk/javascript

dominic-clerk · 2026-10-29T07:14:39Z

Description

Stacked on #10485. Moves tslib from dependencies to devDependencies in backend, electron, expo, expo-native-components, express, nextjs, react, react-router and tanstack-react-start. These build with tsup/tsdown, which inline their own helpers, so no published file imports tslib; it's only needed for type-checking with importHelpers.

Packed tarballs are unchanged apart from the manifest
Consumers of these packages no longer install tslib through them

Bundled deps in clerk-js and ui stay in dependencies on purpose (9ee9ee3) so consumer audit/SBOM tooling still sees shipped code.

Part of SEC-493

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

🤖 Generated with Claude Code

vercel · 2026-10-29T07:14:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 29, 2026 12:31pm UTC
swingset	Ready	Preview	Oct 29, 2026 12:31pm UTC

coderabbitai · 2026-10-29T07:14:50Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Run configuration

Source mode: Auto
Repository: clerk/javascript
Branch: dominic/sec-493-fix-dependency-scopes
File: .coderabbit.yaml
Commit: 645d197
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Team
Run ID: f416b20d-0d04-412a-8daf-7be9be3df470

Commits

Reviewing files that changed from the base of the PR and between fdf7509 and 645d197.

Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: clerk/javascript
Branch: dominic/sec-493-fix-dependency-scopes
File: .coderabbit.yaml
Commit: fdf7509
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Team
Run ID: 687ba4a7-eaa0-431f-b9d9-1d971164b5e5

Commits

Reviewing files that changed from the base of the PR and between 90a9b2b and fdf7509.

Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 10

.changeset/drop-tslib-runtime-dependency.md
packages/backend/package.json
packages/electron/package.json
packages/expo-native-components/package.json
packages/expo/package.json
packages/express/package.json
packages/nextjs/package.json
packages/react-router/package.json
packages/react/package.json
packages/tanstack-react-start/package.json

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go (manual)
clerk/dashboard (manual)
clerk/accounts (manual)
clerk/backoffice (manual)
clerk/clerk (manual)
clerk/clerk-docs (manual)
clerk/cloudflare-workers (manual)
clerk/clerk-android (auto-detected)
clerk/cli (auto-detected)
clerk/clerk-ios (auto-detected)

Included review availability: This review used your included allowance. 6 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

Walkthrough

Several package manifests move tslib between runtime and development dependencies. The Expo native components package moves tslib to runtime dependencies. The Expo package moves react-native-url-polyfill to development dependencies. The Express and React packages list @clerk/shared as a runtime dependency. A changeset records patch releases for nine Clerk packages and states that tslib is no longer installed as a runtime dependency.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: clerk-cookie, wobsoriano

Merge Risk: Minimal · previous review fdf75

No concrete runtime, packaging, security, or availability defect remains established for this dependency-scope change.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: moving tslib from dependencies to devDependencies.
Description check		The description directly explains the dependency changes, affected packages, rationale, validation, and intentional exceptions.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (10 skipped: 10 unsupported.)

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}

changeset-bot · 2026-10-29T07:14:50Z

🦋 Changeset detected

Latest commit: 645d197

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages

Name	Type
@clerk/backend	Patch
@clerk/electron	Patch
@clerk/expo	Patch
@clerk/expo-native-components	Patch
@clerk/express	Patch
@clerk/nextjs	Patch
@clerk/react	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/astro	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nuxt	Patch
@clerk/testing	Patch
@clerk/swingset	Patch
@clerk/chrome-extension	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pkg-pr-new · 2026-10-29T12:33:32Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10521

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10521

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10521

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10521

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10521

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10521

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10521

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10521

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10521

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10521

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10521

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10521

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10521

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10521

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10521

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10521

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10521

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10521

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10521

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10521

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10521

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10521

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10521

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10521

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10521

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10521

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10521

commit: 645d197

github-actions · 2026-10-29T12:36:10Z

API Changes Report

Generated by Break Check on 2026-10-29T12:36:07.561Z

Summary

Metric	Count
Packages analyzed	20
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

Report generated by Break Check

_{Last ran on 645d197.}

dominic-clerk mentioned this pull request Oct 29, 2026

chore(repo): Exclude test files from published packages #10522

Open

3 of 9 tasks

vercel Bot deployed to Preview – clerk-js-sandbox October 29, 2026 07:15

View deployment

vercel Bot deployed to Preview – swingset October 29, 2026 07:16

View deployment

dominic-clerk force-pushed the dominic/sec-493-fix-dependency-scopes branch from 30ff2c4 to fdf7509 Compare October 29, 2026 07:22

github-actions Bot added nextjs react backend expo express tanstack react-router expo-native-components labels Oct 29, 2026

vercel Bot deployed to Preview – clerk-js-sandbox October 29, 2026 07:23

View deployment

vercel Bot deployed to Preview – swingset October 29, 2026 07:25

View deployment

dominic-clerk added this pull request to stack #10486 October 29, 2026 07:29

Base automatically changed from dominic/sec-493-consolidate-overlapping-deps to main October 29, 2026 12:29

chore(repo): Move tslib to devDependencies

645d197

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dominic-clerk force-pushed the dominic/sec-493-fix-dependency-scopes branch from fdf7509 to 645d197 Compare October 29, 2026 12:29

vercel Bot deployed to Preview – clerk-js-sandbox October 29, 2026 12:29

View deployment

vercel Bot deployed to Preview – swingset October 29, 2026 12:31

View deployment

Navigation Menu

Repository navigation

chore(repo): Move tslib to devDependencies - #10521

chore(repo): Move tslib to devDependencies#10521
dominic-clerk wants to merge 1 commit into
mainfrom
dominic/sec-493-fix-dependency-scopes

dominic-clerk commented Oct 29, 2026

Uh oh!

vercel Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

Review skipped

Uh oh!

changeset-bot Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dominic-clerk commented Oct 29, 2026

Description

Checklist

Type of change

Uh oh!

vercel Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

changeset-bot Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

API Changes Report

Summary

No API Changes Detected

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 29, 2026 •

edited

Loading

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

changeset-bot Bot commented Oct 29, 2026 •

edited

Loading