[dependabot]

Bumps @clerk/localizations from 4.16.1 to 4.22.1.

Release notes

Sourced from @​clerk/localizations's releases.

@​clerk/localizations@​4.22.1

Patch Changes

• Updated dependencies [568c668]:
  • @​clerk/shared@​4.39.1

@​clerk/localizations@​4.22.0

Minor Changes

• The self-serve SSO configuration (<OrganizationProfile /> enterprise connection page and the ConfigureSSO SAML steps) now shows every IdP signing certificate a SAML connection trusts, with its expiry, and lets an admin add certificates from a file (a PEM bundle adds several) or remove one, so an IdP key rotation no longer needs a replacement timed with the IdP. Saving sends the whole list and only when it changed. The list holds at most five certificates. New configureSSOCertificateList* and configureSSOCertificatePrimaryBadge appearance element descriptors cover the list, and new configureSSO.signingCertificates.* localization keys hold its strings. (#10012) by @​mauricioabreu

Patch Changes

• Updated dependencies [2654caa]:
  • @​clerk/shared@​4.39.0

@​clerk/localizations@​4.21.1

Patch Changes

• Updated dependencies [c8eb8d5]:
  • @​clerk/shared@​4.37.1

@​clerk/localizations@​4.20.0

Minor Changes

• <SignIn /> and <SignUp /> show a dedicated screen when a request is blocked, with a reference the user can quote to support. (#9600) by @​zourzouvillys

  action_blocked errors now expose traceId, title, description, linkUrl, linkText, kind and data on meta.

Patch Changes

• Fix enterprise SSO sign-ins erroring instead of showing a verification challenge raised while handing off to the identity provider. (#9619) by @​zourzouvillys

  If you use the prebuilt <SignIn /> component, there is nothing to do. If you have Clerk Protect enabled and call signIn.authenticateWithRedirect() or signIn.authenticateWithPopup() from a custom sign-in flow, catch a ClerkRuntimeError with code protect_check_required and show the verification challenge, to avoid a stalled sign-in.

  That error means a verification challenge has to be completed before the sign-in can redirect. It replaces the generic "not supported" error these methods threw before. When it is thrown, the sign-in is gated: signIn.protectCheck is set, or its status is needs_protect_check. For enterprise SSO, run the challenge and then call authenticateWithRedirect() again with continueSignIn: true. If the server has already prepared the redirect, the sign-in continues to the identity provider and the challenge runs when it returns, so no error is thrown.

• Updated dependencies [645a532, 84ee588, 4e538ac]:

  • @​clerk/shared@​4.36.0

Changelog

Sourced from @​clerk/localizations's changelog.

4.22.1

Patch Changes

• Updated dependencies [568c668]:
  • @​clerk/shared@​4.39.1

4.22.0

Minor Changes

• The self-serve SSO configuration (<OrganizationProfile /> enterprise connection page and the ConfigureSSO SAML steps) now shows every IdP signing certificate a SAML connection trusts, with its expiry, and lets an admin add certificates from a file (a PEM bundle adds several) or remove one, so an IdP key rotation no longer needs a replacement timed with the IdP. Saving sends the whole list and only when it changed. The list holds at most five certificates. New configureSSOCertificateList* and configureSSOCertificatePrimaryBadge appearance element descriptors cover the list, and new configureSSO.signingCertificates.* localization keys hold its strings. (#10012) by @​mauricioabreu

Patch Changes

• Updated dependencies [2654caa]:
  • @​clerk/shared@​4.39.0

4.21.2

Patch Changes

• Updated dependencies [f6937c8]:
  • @​clerk/shared@​4.38.0

4.21.1

Patch Changes

• Updated dependencies [c8eb8d5]:
  • @​clerk/shared@​4.37.1

4.21.0

Minor Changes

• Support Google Workspace directories in Directory Sync. Organization admins can upload a service account key and delegated admin email from the setup flow, start a sync on demand, and see the result of the last one. DirectorySync gains setCredentials(), sync(), getSyncStatus(), and credentialsConfigured. (#9722) by @​gabrielmeloc22

• Update the SSO and Directory Sync sections of the <OrganizationProfile /> Security page to the latest designs. Both sections now show a "Configure" button until something is set up (SSO then shows "Add connection"), and SSO connection rows show the identity provider's logo and an actions menu (Edit, Continue configuration, Activate/Deactivate, Remove). These actions have been removed from the SSO connection page, and status badges are no longer color-coded. Okta logos now follow the theme's foreground color, so they stay visible in dark mode, including on the enterprise connection chooser and in <UserProfile />. (#9940) by @​kalafut

  The SSO button uses the new ssoSection.primaryButton__configure localization key; ssoSection.primaryButton__startConfiguration is deprecated and no longer used. In directorySyncSection, primaryButton__startConfiguration is renamed to primaryButton__configure and badge__unconfigured is removed.

Patch Changes

• Add a localized message for the too_many_unverified_identifications error, shown when adding an email address or phone number is blocked by pending verifications or an incomplete passkey setup. (#9812) by @​brunol95

• Updated dependencies [6a14691, 0ee4ee2, 7a3fcf5, 69c1b9c, d9cf0f2]:

  • @​clerk/shared@​4.37.0

4.20.0

... (truncated)

Commits

• ff81d5a ci(repo): Version packages (#10074)
• 2e29745 ci(repo): Version packages (#10025)
• a989859 feat(ui): list and manage the IdP signing certificates of a SAML connection (...
• 6fd8e8d ci(repo): Version packages (#10021)
• 2e03a39 ci(repo): Version packages (#9977)
• 26feba7 ci(repo): Version packages (#9933)
• d9cf0f2 fix(ui): update self-serve sso & directory sync to latest designs (#9940)
• 69c1b9c fix(clerk-js,ui): clean up abandoned passkey registrations (#9812)
• 0ee4ee2 feat(ui): set up Google Workspace directories in the sync wizard (#9722)
• 750e7fc ci(repo): Version packages (#9931)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • No user-facing changes are included in this update. There are no new features, bug fixes, or changes to the app’s behavior for end users.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
car-check	Error		Oct 11, 2026 8:19am UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d529d54d-aa68-4964-9c04-527ea7a3db58

---

📥 Commits

Reviewing files that changed from the base of the PR and between ae94548 and 4417e00.

---

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

---

📒 Files selected for processing (1)

• package.json

---

Limit details: You’ve used all 10 included reviews currently available.

---

---

📝 Walkthrough

Walkthrough

The @clerk/localizations dependency range in package.json changes from ^4.16.1 to ^4.22.1.

Changes

Localization dependency

Layer / File(s)	Summary
Update localization dependency range package.json	The @clerk/localizations dependency range changes from ^4.16.1 to ^4.22.1.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

---

Merge Risk: ⚪ Minimal · up to 4417e

The updated dependency preserves the application’s German localization import and usage, with no concrete compatibility issue identified; the change is mergeable subject to normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 4417e

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in package.json: Updated the @clerk/localizations dependency range from ^4.16.1 to ^4.22.1.

---

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the dependency update from @clerk/localizations 4.16.1 to 4.22.1, which matches the pull request changes.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 1
• Waived: $0.25 (charged $0.00)
• View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

---

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #424.