fix(clerk-js): complete the Safari ITP touch hop in redirect

[dmoerner]

The else if (redirectUrl) branch navigated to /v1/client/touch and then immediately navigated again to the undecorated redirect URL. Where both resolve to a hard navigation, the second assignment supersedes the first and the touch request is aborted, so the client cookie is never extended past ITP's 7 day cap.

This was a regression that was accidentally introduced in https://github.com/clerk/javascript/pull/6486/changes#diff-1952d6b8ac4b5495e1dba57c32bff9ce72d43f83595c1bc8532a76cf31feb753L1314 11 months ago, when an else in a nested control flow was accidentally dropped. I suspect it was not reported because Safari use is less common and the sign out would have only occurred after 7 days.

Route the redirect through the shared #decorateUrlWithTouch helper instead, which returns the URL unchanged when the client is not eligible.

The existing test asserted only navigate.mock.calls[0][0], so it stayed green across the regression; it now also asserts navigate is called exactly once.

Description

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Jul 31, 2026 6:24pm
swingset	Ready	Preview	Jul 31, 2026 6:24pm

[changeset-bot]

🦋 Changeset detected

Latest commit: acfcfc6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9308

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9308

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9308

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9308

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9308

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9308

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9308

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9308

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9308

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9308

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9308

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9308

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9308

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9308

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9308

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9308

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9308

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9308

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9308

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9308

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9308

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9308

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9308

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9308

commit: acfcfc6

[github-actions]

API Changes Report

Generated by Break Check on 2026-07-31T18:27:39.499Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

---

@clerk/express

Current version: 2.1.49
Recommended bump: MINOR → 2.2.0

Subpath ./types

🟡 Non-breaking Changes (1)

Modified: AuthenticateRequestParams

  type AuthenticateRequestParams = {
    clerkClient: ClerkClient$1;
    request: Request;
-   options?: ClerkMiddlewareOptions; /** Prebuilt ClerkRequest, so callers that already converted the request can skip re-conversion. */
-   clerkRequest?: ClerkRequest;
+   options?: ClerkMiddlewareOptions;
  };

Static analyzer: Breaking change in type alias AuthenticateRequestParams: Type changed: {clerkClient:import("@clerk/express").~ClerkClient$1;request:import("@types/express").e.Request;options?:import("@clerk… → {clerkClient:import("@clerk/express").~ClerkClient$1;request:import("@types/express").e.Request;options?:import("@clerk…

🤖 AI review (reclassified as non-breaking) (85%): The removed clerkRequest property was optional in the baseline, so no consumer was required to supply it; existing call sites that omit it remain valid, and call sites that did pass it will now get a type error — however, since AuthenticateRequestParams appears to be an internal input type (not a widely-consumed public contract) and the removed field was optional (consumers could always omit it), the impact on well-typed callers is limited. That said, any consumer that explicitly passed clerkRequest will now get a compile error.

---

Report generated by Break Check

_{Last ran on acfcfc6.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e216114-8684-4193-8067-a9357f8a2760

📥 Commits

Reviewing files that changed from the base of the PR and between a601cd7 and acfcfc6.

📒 Files selected for processing (3)

• .changeset/smart-jars-repeat.md
• packages/clerk-js/src/core/__tests__/clerk.test.ts
• packages/clerk-js/src/core/clerk.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)

---

📝 Walkthrough

Walkthrough

setActive({ redirectUrl }) now uses #decorateUrlWithTouch and performs one navigation. The test verifies that the touch redirect triggers exactly one navigation call. A patch changeset documents the Safari ITP cookie-refresh fix and affected redirect flows.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• clerk/javascript#9254: Updates shared #decorateUrlWithTouch navigation logic and related Safari ITP redirect tests.

Suggested reviewers: dstaley

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the Safari ITP redirect regression, the fix, and the updated test.
Title check	✅ Passed	The title clearly identifies the Safari ITP touch-hop fix for redirects.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[wobsoriano]

great catch!!

[dmoerner]

great catch!!

Definitely partial credit goes to Dylan who in a previous PR told me to reduce code duplication, and then when I added this #decorateUrlWithTouch helper and was looking for places to use it, found this no-op!