fix(backend): Clock skew of 0 should not fall back by dominic-clerk · Pull Request #8359 · clerk/javascript

dominic-clerk · 2026-04-20T10:34:58Z

Description

Because 0 is falsy the current code fell back to the default value when the clock skew was configured to 0. This changes the syntax to fall back on null-ish values which 0 is not.

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Because 0 is falsy the current code fell back to the default value when the clock skew was configured to 0. This changes the syntax to fall back on null-ish values which 0 is not.

changeset-bot · 2026-04-20T10:35:03Z

🦋 Changeset detected

Latest commit: b6571c6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-04-20T10:35:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Apr 20, 2026 5:29pm

pkg-pr-new · 2026-04-20T10:37:53Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8359

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8359

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8359

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8359

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8359

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8359

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8359

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8359

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8359

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8359

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8359

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8359

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8359

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8359

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8359

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8359

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8359

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8359

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8359

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8359

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8359

commit: b6571c6

coderabbitai · 2026-04-20T10:41:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 983c696a-327b-4b84-9997-b441bc296e15

📥 Commits

Reviewing files that changed from the base of the PR and between 9aa73e2 and b6571c6.

📒 Files selected for processing (2)

packages/backend/src/jwt/__tests__/verifyJwt.test.ts
packages/backend/src/jwt/verifyJwt.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/backend/src/jwt/verifyJwt.ts

📝 Walkthrough

Walkthrough

Replaced the previous clockSkew fallback in packages/backend/src/jwt/verifyJwt.ts so that clockSkewInMs is used when it is a finite numeric value (including 0); the default DEFAULT_CLOCK_SKEW_IN_MS is used only when clockSkewInMs is not a finite number (e.g., undefined, NaN, Infinity). Added tests in packages/backend/src/jwt/__tests__/verifyJwt.test.ts covering expiry behavior for clockSkewInMs values 0, omitted (default), NaN, and Infinity (including advancing system time in one test). Added a changeset .changeset/wacky-dryers-hammer.md documenting a patch bump for @clerk/backend and the 0 clock skew behavior.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and accurately summarizes the main bug fix: changing clock skew fallback logic to preserve the value 0 instead of treating it as falsy.
Description check	✅ Passed	The description is directly related to the changeset, explaining the bug (0 being falsy causing unwanted fallback) and the fix (using nullish checking instead of logical OR).

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/backend/src/jwt/verifyJwt.ts`:
- Line 134: The resolved clockSkew value currently uses nullish coalescing but
can remain NaN; before calling assertExpirationClaim, assertActivationClaim, and
assertIssuedAtClaim validate that clockSkew (the const clockSkew variable) is a
finite number (e.g., Number.isFinite(clockSkew)), and if not replace it with
DEFAULT_CLOCK_SKEW_IN_MS or throw a descriptive error; update the code around
the clockSkew assignment so callers passing NaN cannot bypass claim checks by
ensuring a finite skew is passed into
assertExpirationClaim/assertActivationClaim/assertIssuedAtClaim.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 478f1c59-4092-4cbe-828b-319201b9cd77

📥 Commits

Reviewing files that changed from the base of the PR and between d7758e3 and 0cdc524.

📒 Files selected for processing (2)

.changeset/wacky-dryers-hammer.md
packages/backend/src/jwt/verifyJwt.ts

jacekradko

Good enhancement, but we should add tests for this

wobsoriano

thanks for the tests!

fix(backend): Clock skew of 0 should not fall back

0cdc524

Because 0 is falsy the current code fell back to the default value when the clock skew was configured to 0. This changes the syntax to fall back on null-ish values which 0 is not.

github-actions bot added the backend label Apr 20, 2026

vercel bot deployed to Preview April 20, 2026 10:35 View deployment

coderabbitai bot reviewed Apr 20, 2026

View reviewed changes

Comment thread packages/backend/src/jwt/verifyJwt.ts Outdated

jacekradko reviewed Apr 20, 2026

View reviewed changes

Add tests

9aa73e2

vercel bot deployed to Preview April 20, 2026 14:33 View deployment

Reject NaN and infinite

b6571c6

vercel bot deployed to Preview April 20, 2026 17:29 View deployment

wobsoriano approved these changes Apr 20, 2026

View reviewed changes

jacekradko approved these changes Apr 20, 2026

View reviewed changes

dominic-clerk merged commit abaa339 into main Apr 21, 2026
42 checks passed

dominic-clerk deleted the dc-clock-skew-zero branch April 21, 2026 05:51

clerk-cookie mentioned this pull request Apr 20, 2026

ci(repo): Version packages #8363

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(backend): Clock skew of 0 should not fall back#8359

fix(backend): Clock skew of 0 should not fall back#8359
dominic-clerk merged 3 commits intomainfrom
dc-clock-skew-zero

dominic-clerk commented Apr 20, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

vercel bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Apr 20, 2026 •

edited

Loading

Walkthrough

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

jacekradko left a comment

Uh oh!

wobsoriano left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dominic-clerk commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Uh oh!

changeset-bot bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jacekradko left a comment

Choose a reason for hiding this comment

Uh oh!

wobsoriano left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dominic-clerk commented Apr 20, 2026 •

edited

Loading

changeset-bot bot commented Apr 20, 2026 •

edited

Loading

vercel bot commented Apr 20, 2026 •

edited

Loading

pkg-pr-new bot commented Apr 20, 2026 •

edited

Loading

coderabbitai bot commented Apr 20, 2026 •

edited

Loading