@clerk/fastify

Patch Changes

• Add an internal __internal_enableHandshake option to clerkPlugin() (defaults to true). When set to false, the plugin skips the handshake flow and strips handshake cookies and query params before authenticating requests. Intended for API-only backends that cannot return Set-Cookie headers to the browser.

Patch Changes

• security

  Respond with 400 Bad Request instead of surfacing a 500 when an incoming request cannot be represented as a fetch Request. Vulnerability-scanner probes such as hostless // request targets, targets that parse as credentialed URLs, and forbidden methods like TRACE previously threw inside the middleware and polluted error logs.