Packages

@clerk/react

6.18.0 · 20 Oct 2026MIT1.9M / weekRepositoryHomepagenpmAtom feed

Latest releases

All 82 releases

  1. 6.18.0

    20 Oct 2026

    • Support passkeys as a second factor during sign-in and session reverification.

      When a user has a passkey, the prebuilt <SignIn/> and <UserVerification/>
      components preselect it as the second factor, as they already do for the first
      factor. Other methods stay available under "Use another method".

      To use it, your instance must allow passkeys to satisfy the second factor. This
      is on by default for instances created after 2026-07-08, and can be turned on
      in the Dashboard for older ones. Web apps also need to opt in to the passkey
      second factor update in the Dashboard.

      If you build a custom flow, supportedSecondFactors can now include passkey.
      Call signIn.authenticateWithPasskey() to complete it.

      Passkeys are no longer preselected, for either factor, where the SDK reports
      that WebAuthn is unavailable (for example, Electron apps without passkey
      support enabled).

  2. 6.17.8

    9 Oct 2026

    Only updates a dependency:@clerk/shared 4.40.0

  3. 6.17.7

    7 Oct 2026

    • Fix <HandleSSOCallback /> dropping the error when a Clerk Protect challenge fails on the SSO callback. The error is now available on errors from useSignIn() or useSignUp(), and a failed sign-up challenge calls navigateToSignUp instead of navigateToSignIn.

  4. 6.17.5 – 6.17.62 releases that only update dependencies@clerk/shared 4.39.0Show each

  5. 6.17.4

    30 Sep 2026

    • Custom flows built with useSignIn() and useSignUp() now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to <HandleSSOCallback />. Classic resource methods such as clerk.client.signIn.create(), and apps without Clerk's UI loaded, still return with protectCheck set, as before.

Dependency tracking · free for 3 projects

Know when your own dependencies move

@clerk/react had 1 security advisory in the last 12 months. Inlinr emails you the day one touches a project of yours, with the version that fixes it.

  • Advisories reach you

    An email when a critical or high advisory affects a project, before the next install.

  • Upgrades checked first

    Peer ranges, Node, ESM-only and types changes read before you bump.

  • Only what matters

    Majors and breaking notes stay; patches and sibling bumps fold into one line.

How dependency tracking works

Registry facts last checked 23 Oct 2026. Releases and advisories last read 23 Oct 2026.