Conversation
Every Core 2 backport publishes new @clerk/clerk-react, @clerk/types and @clerk/clerk-expo versions that npm resolves to on a bare install with no deprecation warning, because npm skips deprecated versions when an undeprecated one exists. Deprecate the just-published versions of those packages as the last step of the release job so the warning stays in place. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: clerk/javascript/.coderabbit.yaml Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
🦋 Changeset detectedLatest commit: 6edc6c9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
An `if` without a status function gets an implicit `success()`, so a failed Slack notification would have skipped deprecating the versions that were already published. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This branch had an error being deployed
1 participant
Description
Every Core 2 backport publishes new
@clerk/clerk-react,@clerk/types, and@clerk/clerk-expoversions that nobody deprecates. npm skips deprecated versions when an undeprecated one exists, so a barenpm install @clerk/clerk-reactresolves to the newest backport and prints no warning. The 2026-09-18 release (#9832) reopened this for all three packages after the one-offnpm deprecateruns from DOCS-12163 had closed it.This adds a last step to the Core 2 release job that deprecates the newly published versions of those three packages, reusing each package's existing registry message. It runs after the Slack notification so a failure can't hide the release, still runs if that notification fails, and fails the job if the message doesn't stick. Auth goes through
secrets.NPM_TOKENin a temp.npmrc, so the trusted-publishingchangeset publishstep is unchanged.To exercise the script without touching the registry:
DRY_RUN=1 node scripts/deprecate-superseded.mjs '[{"name":"@clerk/clerk-react","version":"5.61.10"}]'.Two things this doesn't cover: snapshot and canary prereleases from
release-snapshot.yml(bare installs never resolve to them), and confirmingNPM_TOKENhas write access on these three packages. Whoever owns that secret would know.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
🤖 Generated with Claude Code