[dominic-clerk]

Description

Stacked on #10485. Moves tslib from dependencies to devDependencies in backend, electron, expo, expo-native-components, express, nextjs, react, react-router and tanstack-react-start. These build with tsup/tsdown, which inline their own helpers, so no published file imports tslib; it's only needed for type-checking with importHelpers.

• Packed tarballs are unchanged apart from the manifest
• Consumers of these packages no longer install tslib through them

Bundled deps in clerk-js and ui stay in dependencies on purpose (9ee9ee3) so consumer audit/SBOM tooling still sees shipped code.

Part of SEC-493

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 29, 2026 7:25am UTC
swingset	Ready	Preview	Oct 29, 2026 7:25am UTC

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: clerk/javascript
• Branch: dominic/sec-493-fix-dependency-scopes
• File: .coderabbit.yaml
• Commit: fdf7509
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: 687ba4a7-eaa0-431f-b9d9-1d971164b5e5

Commits

Reviewing files that changed from the base of the PR and between 90a9b2b and fdf7509.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 10

• .changeset/drop-tslib-runtime-dependency.md
• packages/backend/package.json
• packages/electron/package.json
• packages/expo-native-components/package.json
• packages/expo/package.json
• packages/express/package.json
• packages/nextjs/package.json
• packages/react-router/package.json
• packages/react/package.json
• packages/tanstack-react-start/package.json

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)
• clerk/clerk-ios (auto-detected)

Included review availability: This review used your included allowance. 6 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

Walkthrough

Several package manifests move tslib between runtime and development dependencies. The Expo native components package moves tslib to runtime dependencies. The Expo package moves react-native-url-polyfill to development dependencies. The Express and React packages list @clerk/shared as a runtime dependency. A changeset records patch releases for nine Clerk packages and states that tslib is no longer installed as a runtime dependency.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: clerk-cookie, wobsoriano

Merge Risk: Minimal · up to fdf75

No concrete runtime, packaging, security, or availability defect remains established for this dependency-scope change.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: moving tslib from dependencies to devDependencies.
Description check		The description directly explains the dependency changes, affected packages, rationale, validation, and intentional exceptions.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (10 skipped: 10 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

🦋 Changeset detected

Latest commit: fdf7509

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages

Name	Type
@clerk/backend	Patch
@clerk/electron	Patch
@clerk/expo	Patch
@clerk/expo-native-components	Patch
@clerk/express	Patch
@clerk/nextjs	Patch
@clerk/react	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/astro	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nuxt	Patch
@clerk/testing	Patch
@clerk/swingset	Patch
@clerk/chrome-extension	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR