fix(ui): clarify private metadata OAuth consent copy by jescalan · Pull Request #9226 · clerk/javascript

jescalan · 2026-07-23T17:57:52Z

Summary

Updates OAuth consent copy for the private_metadata scope so users understand it may include sensitive information set by the Clerk application. The backend provides a safer generic description for older or non-Clerk consumers, while the official UI names the Clerk application directly. Consent-screen eligibility and authorization behavior are unchanged.

Linear: https://linear.app/clerk/issue/USER-5731

Changes in this repo

Replaces the official consent UI description with a Clerk application-specific warning, adds focused component coverage, and includes the @clerk/ui patch changeset.

Companion PRs

clerk_go: https://github.com/clerk/clerk_go/pull/20663

vercel · 2026-07-23T17:57:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jul 23, 2026 8:30pm
swingset	Ready	Preview, Comment	Jul 23, 2026 8:30pm

chatgpt-codex-connector · 2026-07-23T17:57:56Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

changeset-bot · 2026-07-23T17:58:00Z

🦋 Changeset detected

Latest commit: ed45b7b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 23 packages

Name	Type
@clerk/localizations	Patch
@clerk/shared	Patch
@clerk/ui	Patch
@clerk/react	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/electron	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/headless	Patch
@clerk/hono	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/vue	Patch
@clerk/swingset	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-23T17:58:02Z

Warning

Review limit reached

@jescalan, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: df12f01a-9bd0-4b17-9d89-7c2fe99be0bf

📥 Commits

Reviewing files that changed from the base of the PR and between acef8a1 and ed45b7b.

📒 Files selected for processing (53)

.changeset/silly-coins-consent.md
packages/localizations/src/ar-SA.ts
packages/localizations/src/be-BY.ts
packages/localizations/src/bg-BG.ts
packages/localizations/src/bn-IN.ts
packages/localizations/src/ca-ES.ts
packages/localizations/src/cs-CZ.ts
packages/localizations/src/da-DK.ts
packages/localizations/src/de-DE.ts
packages/localizations/src/el-GR.ts
packages/localizations/src/en-GB.ts
packages/localizations/src/en-US.ts
packages/localizations/src/es-CR.ts
packages/localizations/src/es-ES.ts
packages/localizations/src/es-MX.ts
packages/localizations/src/es-UY.ts
packages/localizations/src/fa-IR.ts
packages/localizations/src/fi-FI.ts
packages/localizations/src/fr-FR.ts
packages/localizations/src/he-IL.ts
packages/localizations/src/hi-IN.ts
packages/localizations/src/hr-HR.ts
packages/localizations/src/hu-HU.ts
packages/localizations/src/id-ID.ts
packages/localizations/src/is-IS.ts
packages/localizations/src/it-IT.ts
packages/localizations/src/ja-JP.ts
packages/localizations/src/kk-KZ.ts
packages/localizations/src/ko-KR.ts
packages/localizations/src/mn-MN.ts
packages/localizations/src/ms-MY.ts
packages/localizations/src/nb-NO.ts
packages/localizations/src/nl-BE.ts
packages/localizations/src/nl-NL.ts
packages/localizations/src/pl-PL.ts
packages/localizations/src/pt-BR.ts
packages/localizations/src/pt-PT.ts
packages/localizations/src/ro-RO.ts
packages/localizations/src/ru-RU.ts
packages/localizations/src/sk-SK.ts
packages/localizations/src/sr-RS.ts
packages/localizations/src/sv-SE.ts
packages/localizations/src/ta-IN.ts
packages/localizations/src/te-IN.ts
packages/localizations/src/th-TH.ts
packages/localizations/src/tr-TR.ts
packages/localizations/src/uk-UA.ts
packages/localizations/src/vi-VN.ts
packages/localizations/src/zh-CN.ts
packages/localizations/src/zh-TW.ts
packages/shared/src/types/localization.ts
packages/ui/src/components/OAuthConsent/OAuthConsent.tsx
packages/ui/src/components/OAuthConsent/__tests__/OAuthConsent.test.tsx

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-07-23T18:01:35Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9226

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9226

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9226

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9226

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9226

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9226

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9226

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9226

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9226

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9226

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9226

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9226

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9226

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9226

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9226

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9226

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9226

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9226

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9226

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9226

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9226

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9226

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9226

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9226

commit: ed45b7b

github-actions · 2026-07-23T18:02:22Z

API Changes Report

Generated by Break Check on 2026-07-23T20:34:36.392Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

@clerk/shared

Current version: 4.25.7
Recommended bump: MINOR → 4.26.0

Subpath `./types`

🟡 Non-breaking Changes (1)

Modified: `__internal_LocalizationResource`

// ... 1247 unchanged lines elided ...
    oauthConsent: {
      subtitle: LocalizationValue<'applicationName' | 'identifier'>;
      scopeList: {
+       privateMetadata: LocalizationValue<'applicationName'>;
        title: LocalizationValue<'applicationName'>;
      };
      action__deny: LocalizationValue;
// ... 727 unchanged lines elided ...

Static analyzer: Breaking change in type alias __internal_LocalizationResource: Type changed: {locale:string;maintenanceMode:import("@clerk/shared").LocalizationValue;roles:{[r:string]:import("@clerk/shared").Loca… → {locale:string;maintenanceMode:import("@clerk/shared").LocalizationValue;roles:{[r:string]:import("@clerk/shared").Loca…

🤖 AI review (reclassified as non-breaking) (70%): The before and after snippets are structurally nearly identical (same fields, same types), with only '1900 lines elided' vs '1901 lines elided' suggesting one new field was added; __internal_LocalizationResource is used only as the source for DeepPartial<DeepLocalizationWithoutObjects<...>> in LocalizationResource (an output/extension type consumers read, not construct directly), so adding a field is non-breaking for consumers.

Report generated by Break Check

_{Last ran on ed45b7b.}

alexcarpenter · 2026-07-23T18:46:28Z

+      ...item,
+      description:
+        item.scope === PRIVATE_METADATA_SCOPE
+          ? `Your private metadata set by ${applicationName}, which may include sensitive information`


@jescalan can we localize this?

Localized the private metadata scope description through oauthConsent.scopeList.privateMetadata, including the applicationName token and an override-focused component test. Addressed in 8e5b64e.

~ 🤖

github-actions Bot added the ui label Jul 23, 2026

vercel Bot deployed to Preview – clerk-js-sandbox July 23, 2026 17:58 View deployment

jescalan changed the title ~~Clarify private metadata in OAuth consent~~ fix(ui): clarify private metadata OAuth consent copy Jul 23, 2026

vercel Bot deployed to Preview – swingset July 23, 2026 18:00 View deployment

jescalan requested a review from dominic-clerk July 23, 2026 18:02

wobsoriano approved these changes Jul 23, 2026

View reviewed changes

alexcarpenter reviewed Jul 23, 2026

View reviewed changes

jescalan added 2 commits July 23, 2026 16:10

fix(ui): clarify private metadata OAuth consent copy

caca4b9

fix(ui): localize private metadata consent copy

8e5b64e

jescalan force-pushed the je/oauth-private-metadata branch from 6c32811 to 8e5b64e Compare July 23, 2026 20:16

github-actions Bot added the localizations label Jul 23, 2026

vercel Bot deployed to Preview – clerk-js-sandbox July 23, 2026 20:17 View deployment

vercel Bot deployed to Preview – swingset July 23, 2026 20:19 View deployment

chore(localizations): align private metadata consent key

ed45b7b

vercel Bot deployed to Preview – clerk-js-sandbox July 23, 2026 20:28 View deployment

vercel Bot deployed to Preview – swingset July 23, 2026 20:30 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(ui): clarify private metadata OAuth consent copy#9226

fix(ui): clarify private metadata OAuth consent copy#9226
jescalan wants to merge 3 commits into
mainfrom
je/oauth-private-metadata

jescalan commented Jul 23, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jul 23, 2026

Uh oh!

changeset-bot Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Review limit reached

Uh oh!

pkg-pr-new Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

alexcarpenter Jul 23, 2026 •

edited

Loading

Uh oh!

jescalan Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jescalan commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes in this repo

Companion PRs

Uh oh!

vercel Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Jul 23, 2026

Uh oh!

changeset-bot Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

pkg-pr-new Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

API Changes Report

Summary

@clerk/shared

Subpath ./types

🟡 Non-breaking Changes (1)

Modified: __internal_LocalizationResource

Uh oh!

alexcarpenter Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jescalan Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jescalan commented Jul 23, 2026 •

edited

Loading

vercel Bot commented Jul 23, 2026 •

edited

Loading

changeset-bot Bot commented Jul 23, 2026 •

edited

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

Subpath `./types`

Modified: `__internal_LocalizationResource`

alexcarpenter Jul 23, 2026 •

edited

Loading