chore(clerk-js): remove redundant dequal dependency

[jacekradko]

Nothing in @clerk/clerk-js imports dequal directly. It was listed as a direct runtime dependency but is only reached transitively through @clerk/shared (useDeepEqualMemo). Drop it from packages/clerk-js/package.json and the lockfile, with a patch changeset.

Resolves AISEC-32. Thanks to @7188ce06 for reporting.

Summary by CodeRabbit

• Chores
  • Streamlined package maintenance by removing an unnecessary internal dependency.
  • No changes to public APIs or end-user functionality.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Error		Jul 17, 2026 3:02pm
swingset	Ready	Preview, Comment	Jul 17, 2026 3:02pm

[changeset-bot]

🦋 Changeset detected

Latest commit: 47f2d98

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b3216d79-0b5e-42b7-9567-094dc14221b7

📥 Commits

Reviewing files that changed from the base of the PR and between 05a9257 and 47f2d98.

📒 Files selected for processing (2)

• .changeset/remove-clerk-js-dequal.md
• packages/clerk-js/package.json

🚧 Files skipped from review as they are similar to previous changes (2)

• .changeset/remove-clerk-js-dequal.md
• packages/clerk-js/package.json

---

📝 Walkthrough

Walkthrough

This PR removes the redundant direct dequal dependency from @clerk/clerk-js and adds a changeset documenting the removal and patch release.

Changes

Dependency cleanup

Layer / File(s)	Summary
Remove dequal dependency packages/clerk-js/package.json, .changeset/remove-clerk-js-dequal.md	Removes dequal from package dependencies and records a patch release changeset.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: alexcarpenter

Poem

I’m a bunny with a tidy tray,
Dequal hops softly away.
A patch note blooms,
In release-room gloom,
While clean deps dance through the day.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: removing the redundant dequal dependency from clerk-js.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8608

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8608

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8608

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8608

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8608

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8608

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8608

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8608

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8608

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8608

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8608

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8608

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8608

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8608

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8608

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8608

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8608

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8608

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8608

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8608

commit: 05a9257

[wobsoriano]

@jacekradko, this PR will use dequal 😃 #8587

(I already reviewed and approved the PR, but if you have bandwidth for a quick scan, Id appreciate it.)

[github-actions]

Snapi: no API changes detected in @clerk/backend, @clerk/clerk-js, @clerk/nextjs, @clerk/react, @clerk/shared, @clerk/ui.

[github-actions]

API Changes Report

Generated by Break Check on 2026-06-03T17:33:45.204Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

Note
Break Check could not snapshot 3 subpaths; the diff below excludes them.

• @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
• @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
• @clerk/testing ./cypress: Symbol not found for identifier: Cypress

---

@clerk/shared

Current version: 4.15.0
Recommended bump: MINOR → 4.16.0

Subpath ./apiUrlFromPublishableKey

🟡 Non-breaking Changes (1)

Modified: apiUrlFromPublishableKey

- apiUrlFromPublishableKey: (publishableKey: string) => "https://api.lclclerk.com" | "https://api.clerkstage.dev" | "https://api.clerk.com"
+ apiUrlFromPublishableKey: (publishableKey: string) => "https://api.clerk.com" | "https://api.lclclerk.com" | "https://api.clerkstage.dev"

Static analyzer: Breaking change in function apiUrlFromPublishableKey: Return type changed: "https://api.lclclerk.com"|"https://api.clerkstage.dev"|"https://api.clerk.com" → "https://api.clerk.com"|"https://api.lclclerk.com"|"https://api.clerkstage.dev"

🤖 AI review (reclassified as non-breaking) (99%): The union members are identical; only their order changed, and TypeScript union types are order-independent — no well-typed consumer code can break from this reordering.

---

Report generated by Break Check

_{Last ran on 05a9257. Pushes that change no tracked declarations (no API surface change vs. base) are skipped and don't update this comment.}

[macroscopeapp]

Approvability

Verdict: Approved

Removes a redundant direct dependency on dequal from clerk-js - the package is already available transitively through @clerk/shared. No code changes, just package.json cleanup.

^{You can customize Macroscope's approvability policy. Learn more.}

[dominic-clerk]

We use dequal now https://github.com/clerk/javascript/blob/89916b0a30565bbbc477c428caeb88087e6cf4de/packages/clerk-js/src/utils/mergePatch.ts