build(deps): bump @clerk/backend from 3.5.0 to 3.13.2 in /dashboard

[dependabot]

Bumps @clerk/backend from 3.5.0 to 3.13.2.

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.13.2

Patch Changes

• Correct two Dashboard labels referenced in the instance restrictions documentation. blockDisposableEmailDomains bolded "Block sign-ups that use disposable email domains", but the toggle in the Clerk Dashboard is "Block sign-ups that use disposable email addresses". ignoreDotsForGmailAddresses bolded "Ignore dots for Gmail addresses" as a Dashboard toggle, but no such control exists — the wording now matches the equivalent comment on UpdateRestrictionsParams. Property names are unchanged. (#9253) by @​manovotny

@​clerk/backend@​3.13.1

Patch Changes

• Updated dependencies [01f2c12]:
  • @​clerk/shared@​4.25.8

@​clerk/backend@​3.13.0

Minor Changes

• Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

• Updated dependencies [097432d]:
  • @​clerk/shared@​4.25.7

@​clerk/backend@​3.12.0

Minor Changes

• Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

• Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

• Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

• Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

  • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
  • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
  • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

• Updated dependencies [858a689, c904fb4]:

  • @​clerk/shared@​4.25.6

Changelog

Sourced from @​clerk/backend's changelog.

3.13.2

Patch Changes

• Correct two Dashboard labels referenced in the instance restrictions documentation. blockDisposableEmailDomains bolded "Block sign-ups that use disposable email domains", but the toggle in the Clerk Dashboard is "Block sign-ups that use disposable email addresses". ignoreDotsForGmailAddresses bolded "Ignore dots for Gmail addresses" as a Dashboard toggle, but no such control exists — the wording now matches the equivalent comment on UpdateRestrictionsParams. Property names are unchanged. (#9253) by @​manovotny

3.13.1

Patch Changes

• Updated dependencies [01f2c12]:
  • @​clerk/shared@​4.25.8

3.13.0

Minor Changes

• Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

• Updated dependencies [097432d]:
  • @​clerk/shared@​4.25.7

3.12.0

Minor Changes

• Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

• Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

• Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

• Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

• Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

• Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

  • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
  • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
  • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

• Updated dependencies [858a689, c904fb4]:

  • @​clerk/shared@​4.25.6

3.11.7

... (truncated)

Commits

• 8c9d061 ci(repo): Version packages (#9251)
• 6f5fde9 docs(backend): Correct Dashboard labels in instance restrictions (#9253)
• 9081534 ci(repo): Version packages (#9240)
• acef8a1 ci(repo): Version packages (#9219)
• 848eefe feat(backend): support configurable Frontend API proxy URLs (#9223)
• 430ae23 ci(repo): Version packages (#9195)
• 858a689 docs(repo): Add trailing comma after e.g. and i.e. in JSDoc (#9201)
• a009d91 fix(backend): Align enterprise connection create and update params with the B...
• ff5d991 fix(backend): Fix cross-origin handshake bypass (#9145)
• 26530ce feat(backend): support organization-scoped sign-in tokens (#9192)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard-skillcheck	Ready	Preview, Comment	Jul 28, 2026 4:44pm