chore(repo): Update Dependencies for Clerk Monorepo to v10 [SECURITY] by renovate[bot] · Pull Request #10063 · clerk/javascript

renovate · 2026-10-03T23:15:00Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@faker-js/faker (source)	`^9.9.0` → `^10.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Faker: helpers.fake exploitable into arbritary code execution

CVE-2026-73231 / GHSA-qxc2-j82w-r537

More information

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);

Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

CVSS Score: 7.8 / 10 (High)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

faker-js/faker (@faker-js/faker)

`v10.5.0`

Compare Source

New Locales

locale: add color to cy (#3816) (5a6379f)
locale: add Farsi airline module locale (#3789) (f4a1c3e)
locale: add mn_MN_cyrl (Mongolian) locale (#3796) (d17c0f1)
locale: Add more realistic Greek address data (#3792) (6153eb7)
locale: Add postal_address and improved secondary_address for es (#3798) (6c2a0ab)
locale: add sl_SI locale, location module (#3652) (28d4f7c)
locale: add Welsh (cy) animal type definitions (#3842) (50a5ec9)
locale: add Welsh (cy) book format definitions (#3846) (#3846) (2b32d6e)
locale: add Welsh (cy) building numbers definition (#3892) (4996a2b)
locale: add Welsh (cy) city name definitions (#3884) (ac36c22)
locale: add Welsh (cy) continents definitions (#3880) (03a1682)
locale: add Welsh (cy) county definitions (#3849) (f51d28a)
locale: add Welsh (cy) direction definitions (#3840) (d862071)
locale: add Welsh (cy) internet domain suffix definitions (#3865) (#3865) (fb2e2cb)
locale: add Welsh (cy) phone number definitions (#3878) (70994db)
locale: add Welsh (cy) postal address definitions (#3850) (e72fd7c)
locale: add Welsh (cy) postcode definitions (#3851) (1afbd59)
locale: add Welsh (cy) sex definitions (#3824) (6f29eb7)
locale: add Welsh (cy) state definitions (#3891) (#3891) (606d47c)
locale: add Welsh (cy) street name definitions (#3889) (143789e)
locale: add Welsh (cy) vehicle fuel definitions (#3845) (29c918a)
locale: extend tr person last names (#3839) (f433771)
locale: improved en_GB postcodes (#3864) (a4e5039)
locale: improved en_IE postal_address (#3797) (fb3ffd3)

Features

add first standalone module functions (#3818) (5d4f5de)
date: add ability to provide date range for recent and soon (#3844) (0bc038d)
date: add ability to provide year range for past and future (#3783) (237e7dc)
food: expand plant-based dish and pattern variety (#3887) (5eaf729)
introduce FakerCore (#2838) (68e15d7)
location: add postal address generation (#3760) (753bec6)
number: add distributor functions (#3375) (325e402)
phone: mobile style for phone.number (#3583) (cd5953b)

Bug Fixes

date: incorrect date boundary in past and future (#3827) (0446411)
finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#3429) (c53c1fe)
food: correct fruit and vegetable locale data (#3800) (30a812a)
handle single-character fromRegExp patterns (#3877) (ec6cc3b)
helpers: ignore wrapper characters in fromRegExp (#3795) (9e2c0e3)
helpers: lazy results in fake (#3852) (5458620)
hide warnings for permanently disabled test stubs (#3860) (03252b9)
link release checklist in release PR workflow (#3802) (8436c4f)
locale: changed farsi phone locales to correct ones (#3775) (5e1ce98)
locale: phone numbers for en_AU (#3788) (eba7d99)
locale: remove citation brackets from snake names (#3822) (bda44d0)
locale: typo in de_CH last name (#3799) (17138d8)
validate unsupported fileExt mime types (#3879) (d11b5d3)

`v10.4.0`

Compare Source

New Locales

locale: add Japanese bear definitions (#3720) (2a4b15c)
locale: add Japanese bird definitions (#3719) (dc31ff8)
locale: add Japanese cat breed definitions (#3716) (54af8a8)
locale: add Japanese cattle breed definitions (#3717) (c2c7342)
locale: add Japanese fish definitions (#3721) (15fc361)
locale: add Japanese horse breed definitions (#3718) (e02536e)
locale: add Norwegian (nb_NO) country definition (#3714) (614b4e9)

Features

fi locale phone numbers (#3747) (7afa8b5)
food: add plant-based dish variety (#3745) (41edf49)

Changed Locales

locale: filter and cleanup PersonEntryDefintions data (#3266) (67defc8)

Bug Fixes

locales: correct typos and capitalization in es_MX street names (#3737) (2b32c28)

`v10.3.0`

Compare Source

New Locales

locale: add Japanese dog definition (#3715) (76c9df1)
locale: add Japanese color definitions (#3707) (bbbb215)
locale: add Japanese food module (#3706) (71d55c0)
locale: add Japanese internet definitions (#3708) (184a709)
locale: add Japanese job definitions for person module (#3705) (e7f3ccd)
locale: add Japanese suffix definitions for person module (#3704) (45ad7d8)
locale: add Norwegian (nb_NO) continent definitions (#3712) (c0f0f23)
locale: add Norwegian (nb_NO) direction definition (#3713) (43b18fa)
locale: add Norwegian (nb_NO) sex definitions (#3710) (76063f2)
locale: add Norwegian (nb_NO) vehicle definition (#3732) (d1c32b0)

Features

locales: add Norwegian (nb_NO) zodiac sign definitions (#3711) (e306542)
person: sexType can return 'generic' (#3259) (0e099a1)
string: support uuid v7 (#3701) (87c2753)

Changed Locales

locale: normalize system locale data (#3702) (ba91653)

Bug Fixes

locale: remove empty string from Hebrew lorem words (#3698) (81a896c)
location: state name to 'Trøndelag' for nb_NO (#3691) (eaef389)

`v10.2.0`

Compare Source

New Locales

locale: add bn_BD location module (#3614) (99a448c)
locale: add counties & states to nb_NO location (#3617) (3dbcbe1)
locale: add da states (regions) (#3656) (78c892b)
locale: add id_ID translation for animal, color, commerce, and word also add country to location id_ID translation. (#3608) (02c2c3e)
locale: add ku_kmr_latin locale (#3629) (247f42d)
locale: add person module data to ku_ckb (#3630) (6be2c20)

Features

Add support for UPC (#3648) (57b2d78)
commerce: allow for locale-specific product name patterns (#3657) (1cf3991)
finance: add IR iban (#3678) (101a74a)
locales: add sl_SI locale, person module (#3564) (e7c9945)
location: Hungarian support for city name, full street address, continents, countries and directions (hu) (#3618) (2c9aefd)

Bug Fixes

food: move raspberry from vegetable to fruit (#3650) (6a4f01f)
locale: endonym should be in Latin script (#3660) (4cda07f)
locale: remove additional inappropriate words from ja locale (#3665) (18a1554)
locale: remove offensive and inappropriate words from ja locale (#3661) (8310c8c)
locale: remove some negative hu words (#3664) (bd36bae)
location: Use accents in en country names (#3637) (24aa11f)
vehicle: Updated spelling Mercielago to Murcielago (#3636) (bfb1bdb)

`v10.1.0`

Compare Source

New Locales

locale: Add ku_ckb locale (#3441) (9de894a)
locale: add Russian localization for book module (#3628) (428ff33)

Bug Fixes

locale: fix the Spring Airlines IATA Code (#3612) (b547045)

`v10.0.0`

Compare Source

New Locales

locale: extended list of colors in Polish (#3586) (9940d54)

Features

locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#3535) (0d2143c)

Changed Locales

locale: remove invalid credit card issuer patterns (#3568) (9783d95)

Configuration

📅 Schedule: (in timezone GMT)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-10-03T23:15:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 3, 2026 11:18pm UTC
swingset	Ready	Preview	Oct 3, 2026 11:18pm UTC

changeset-bot · 2026-10-03T23:15:05Z

⚠️ No Changeset found

Latest commit: eb8c75b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-10-03T23:15:11Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 76c970a4-025d-4fde-a61e-54f35f5933e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-10-03T23:17:51Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10063

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10063

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10063

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10063

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10063

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10063

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10063

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10063

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10063

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10063

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10063

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10063

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10063

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10063

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10063

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10063

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10063

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10063

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10063

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10063

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10063

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10063

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10063

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10063

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10063

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10063

commit: eb8c75b

chore(repo): Update Dependencies for Clerk Monorepo to v10 [SECURITY]

eb8c75b

renovate Bot added the dependencies Pull requests that update a dependency file label Oct 3, 2026

vercel Bot deployed to Preview – clerk-js-sandbox October 3, 2026 23:15 View deployment

vercel Bot deployed to Preview – swingset October 3, 2026 23:18 View deployment

Navigation Menu

chore(repo): Update Dependencies for Clerk Monorepo to v10 [SECURITY] - #10063

chore(repo): Update Dependencies for Clerk Monorepo to v10 [SECURITY]#10063
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-faker-js-faker-vulnerability

renovate Bot commented Oct 3, 2026

Uh oh!

vercel Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 3, 2026

Uh oh!

coderabbitai Bot commented Oct 3, 2026

Review skipped

Uh oh!

pkg-pr-new Bot commented Oct 3, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 3, 2026

Faker: helpers.fake exploitable into arbritary code execution

Details

Summary

Details

PoC

Impact

Severity

References

Release Notes

v10.5.0

New Locales

Features

Bug Fixes

v10.4.0

New Locales

Features

Changed Locales

Bug Fixes

v10.3.0

New Locales

Features

Changed Locales

Bug Fixes

v10.2.0

New Locales

Features

Bug Fixes

v10.1.0

New Locales

Bug Fixes

v10.0.0

New Locales

Features

Changed Locales

Configuration

Uh oh!

vercel Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Oct 3, 2026

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Oct 3, 2026

Review skipped

Uh oh!

pkg-pr-new Bot commented Oct 3, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v10.5.0`

`v10.4.0`

`v10.3.0`

`v10.2.0`

`v10.1.0`

`v10.0.0`

vercel Bot commented Oct 3, 2026 •

edited

Loading