ci(repo): Version packages (Core 2) (#8376)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: clerk-cookie

.changeset/authorization-bypass-combined-conditions.md

@@ -1,5 +1,14 @@
 # @clerk/agent-toolkit
 
+## 0.2.31
+
+### Patch Changes
+
+- Updated dependencies [[`e085a17`](https://github.com/clerk/javascript/commit/e085a174e4b6072022f3ace907bcf020f3216272)]:
+  - @clerk/shared@3.47.5
+  - @clerk/backend@2.33.3
+  - @clerk/types@4.101.23
+
 ## 0.2.30
 
 ### Patch Changes

packages/agent-toolkit/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/agent-toolkit",
-  "version": "0.2.30",
+  "version": "0.2.31",
   "description": "Clerk Toolkit for AI Agents",
   "homepage": "https://clerk.com/",
   "bugs": {

packages/agent-toolkit/package.json

@@ -1,5 +1,14 @@
 # @clerk/astro
 
+## 2.17.11
+
+### Patch Changes
+
+- Updated dependencies [[`e085a17`](https://github.com/clerk/javascript/commit/e085a174e4b6072022f3ace907bcf020f3216272)]:
+  - @clerk/shared@3.47.5
+  - @clerk/backend@2.33.3
+  - @clerk/types@4.101.23
+
 ## 2.17.10
 
 ### Patch Changes

packages/astro/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/astro",
-  "version": "2.17.10",
+  "version": "2.17.11",
   "description": "Clerk SDK for Astro",
   "keywords": [
     "auth",

packages/astro/package.json

@@ -1,5 +1,13 @@
 # Change Log
 
+## 2.33.3
+
+### Patch Changes
+
+- Updated dependencies [[`e085a17`](https://github.com/clerk/javascript/commit/e085a174e4b6072022f3ace907bcf020f3216272)]:
+  - @clerk/shared@3.47.5
+  - @clerk/types@4.101.23
+
 ## 2.33.2
 
 ### Patch Changes

packages/backend/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/backend",
-  "version": "2.33.2",
+  "version": "2.33.3",
   "description": "Clerk Backend SDK - REST Client for Backend API & JWT verification utilities",
   "homepage": "https://clerk.com/",
   "bugs": {

packages/backend/package.json

@@ -1,5 +1,14 @@
 # Change Log
 
+## 2.9.15
+
+### Patch Changes
+
+- Updated dependencies [[`e085a17`](https://github.com/clerk/javascript/commit/e085a174e4b6072022f3ace907bcf020f3216272)]:
+  - @clerk/shared@3.47.5
+  - @clerk/clerk-js@5.125.10
+  - @clerk/clerk-react@5.61.6
+
 ## 2.9.14
 
 ### Patch Changes

packages/chrome-extension/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/chrome-extension",
-  "version": "2.9.14",
+  "version": "2.9.15",
   "description": "Clerk SDK for Chrome extensions",
   "keywords": [
     "auth",

packages/chrome-extension/package.json

@@ -1,5 +1,23 @@
 # Change Log
 
+## 5.125.10
+
+### Patch Changes
+
+- Fix an authorization bypass in `has()`, `auth.protect()`, and related predicates when a single call combined conditions from more than one dimension (for example, `{ permission, reverification }` or `{ feature, permission }`). A dimension that should have denied the request was treated as indeterminate and ignored by the combining logic, allowing other passing dimensions to carry the result and authorize the call when it should have failed closed. ([#8373](https://github.com/clerk/javascript/pull/8373)) by [@nikosdouvlis](https://github.com/nikosdouvlis)
+
+  Behavior is now:
+  - When a requested dimension cannot be satisfied because the underlying session data is missing, malformed, or invalid, the call denies. Previously these cases were treated as indeterminate and ignored, which could let another passing dimension carry the call.
+  - Fixed a minor bug where `session.checkAuthorization()` was building authorization options from the membership row id instead of the organization id.
+
+  Single-condition role, permission, feature, and plan checks (`has({ permission })`, etc.) are unchanged. Single-condition `reverification` checks are unchanged on well-formed session data; calls with a missing or malformed `factorVerificationAge` payload now deny where they previously returned indeterminate. Callback-form `auth.protect(has => ...)` is unaffected unless the callback itself invokes the affected shapes.
+
+  Separately, `auth.protect()` in `@clerk/nextjs` previously discarded authorization params (`role`, `permission`, `feature`, `plan`, `reverification`) whenever the same argument object also contained `unauthenticatedUrl`, `unauthorizedUrl`, or `token`. TypeScript's excess-property check caught this for inline object literals but did not apply once the argument was assigned to a variable, spread, or used from JavaScript. Mixed-shape calls like `auth.protect({ role: 'org:admin', unauthorizedUrl: '/denied' })` or `auth.protect({ permission: 'org:X', token: 'session_token' })` now correctly enforce the authorization check instead of silently letting every authenticated caller through.
+
+- Updated dependencies [[`e085a17`](https://github.com/clerk/javascript/commit/e085a174e4b6072022f3ace907bcf020f3216272)]:
+  - @clerk/shared@3.47.5
+  - @clerk/localizations@3.37.5
+
 ## 5.125.9
 
 ### Patch Changes