[mwickett]

Description

The Clerk Dashboard's Protect section now has a Protections page at /~/protect/protections, and the old /~/protect/rules link redirects to it. This updates the lockUser() JSDoc to link to the new page, and points its "guide on user locks" link at the guide's current URL (/docs/guides/protect/user-lockout); the old /docs/guides/secure/user-lockout URL also redirects.

The lockUser() reference page in the docs is generated from this JSDoc, so the link has to change here and reach the docs through the next Typedoc refresh.

This changes only the comment; there is no runtime change.

Checklist

• pnpm test runs as expected. Not run: the change is to a doc comment only.
• pnpm build runs as expected. Not run, for the same reason. The pre-commit hooks (lint-staged) passed.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated. The generated reference page picks this up from the next Typedoc refresh.

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 23, 2026 8:29pm UTC
swingset	Ready	Preview	Oct 23, 2026 8:29pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 6f571cb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/swingset	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: clerk/javascript
• Branch: mwickett/lockuser-protections-link
• File: .coderabbit.yaml
• Commit: 6f571cb
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: d6c1937a-2f2a-4754-9470-618836e5ae7a

📥 Commits

Reviewing files that changed from the base of the PR and between 9328b10 and 6f571cb.

📒 Files selected for processing: 3

• .changeset/lockuser-protect-protections-link.md
• packages/backend/src/api/endpoints/UserApi.ts
• packages/backend/src/api/resources/User.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)
• clerk/clerk-ios (auto-detected)

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 6 reviews per hour.

📝 Walkthrough

The user-lock documentation links now point to the current guide. The lockUser() documentation names the Protections page under Protect. Its stated one-hour default and lock behavior remain unchanged. A patch changeset records the documentation update.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 6f571

No actionable merge-blocking risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the change: the lockUser() JSDoc now points to the Protections Dashboard page. It matches the main change in the changeset, which updates JSDoc links in UserApi.ts and User.ts and adds…
Description check		The description is directly related to the changeset. It explains that the lockUser() JSDoc link moves to the new Protections page at /~/protect/protections and that the user-lock guide link moves to …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the change: the lockUser() JSDoc now points to the Protections Dashboard page. It matches the main change in the changeset, which updates JSDoc links in UserApi.ts and User.ts and adds a patch changeset. The 'fix(backend)' prefix is a conventional-commit style that fits a comment-only change.

Full details: Description check

Explanation

The description is directly related to the changeset. It explains that the lockUser() JSDoc link moves to the new Protections page at /~/protect/protections and that the user-lock guide link moves to /docs/guides/protect/user-lockout. It also states that only a comment changes and that there is no runtime change, which matches the raw summary.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10395

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10395

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10395

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10395

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10395

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10395

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10395

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10395

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10395

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10395

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10395

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10395

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10395

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10395

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10395

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10395

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10395

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10395

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10395

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10395

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10395

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10395

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10395

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10395

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10395

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10395

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10395

commit: 6f571cb

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T20:08:51.901935Z	9328b10	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

API Changes Report

Generated by Break Check on 2026-10-23T20:31:30.791Z

Summary

Metric	Count
Packages analyzed	20
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 6f571cb.}

[manovotny]

Pushed some changes directly in 6f571cb.

• Pointed the other user-lockout links in the backend JSDoc (unlockUser(), CreateUserParams.locked, and User.locked) at /docs/guides/protect/user-lockout, so their generated pages match lock-user.mdx after the same Typedoc sync
• Updated the changeset to cover all four comments

[SarahSoutoul]

@mwickett @manovotny One heads up before we sync the updated TypeDoc into the public docs: a full sync would also include the abandonAt and expireAt property descriptions for indefinite native sessions currently shown in clerk/clerk#3677. We've held that PR until the feature is ready.

So if we want #3682 to go out without being blocked by Typedoc links, we can hold the sync and temporarily exempt the two generated lockUser() links from docs lint. If we agree with this, I'll put sth up, unless we prefer to just coordinate the release of this with Sam's feature.

[SarahSoutoul]

So if we want #3682 to go out without being blocked by Typedoc links, we can hold the sync and temporarily exempt the two generated lockUser() links from docs lint. If we agree with this, I'll put sth up, unless we prefer to just coordinate the release of this with Sam's feature.

@mwickett @manovotny Quick update after testing a fresh TypeDoc sync from JavaScript main: the epoch-zero wording is gone, so we don't need the lint exemption. I closed the stale #3677 and the test sync #3685. Once javascript#10395 merges, we can run a new sync that includes the Protect link fix.