deps: bump @clerk/backend from 2.33.3 to 3.16.0

[dependabot]

Bumps @clerk/backend from 2.33.3 to 3.16.0.

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.15.0

Minor Changes

• Update fields for BillingSubscription and BillingSubscriptionItem (#9196) by @​dstaley

Patch Changes

• Return a TokenVerificationError from decodeJwt and verifyToken for tokens whose header, payload, or signature cannot be decoded. (#9268) by @​wobsoriano

• Updated dependencies [aaea141]:

  • @​clerk/shared@​4.25.10

@​clerk/backend@​3.14.0

Minor Changes

• Align the EnterpriseConnection response resource with what the Backend API actually returns: (#9156) by @​manovotny
  • EnterpriseConnection now exposes provider, logoPublicUrl, allowOrganizationAccountLinking, authenticatable, disableJitProvisioning, and customAttributes.
  • EnterpriseConnectionSamlConnection now exposes active, forceAuthn, and loginHint.
  • EnterpriseConnectionOauthConfig now exposes providerKey, authUrl, tokenUrl, userInfoUrl, and requiresPkce.
  • Deprecated properties the Backend API never returns, which were always undefined despite their declared types: allowSubdomains on EnterpriseConnection (use samlConnection.allowSubdomains), and idpMetadata and syncUserAttributes on EnterpriseConnectionSamlConnection (use the top-level syncUserAttributes).
  • organizationId is now normalized to null when the Backend API omits it, matching its declared string | null type. Properties backed by optional API fields (for example oauthConfig.clientId and the SAML IdP fields) are now typed as possibly undefined to match runtime behavior.

Patch Changes

• Updated dependencies [2974fb0, e2dd4e2]:
  • @​clerk/shared@​4.25.9

@​clerk/backend@​3.13.2

Patch Changes

• Correct two Dashboard labels referenced in the instance restrictions documentation. blockDisposableEmailDomains bolded "Block sign-ups that use disposable email domains", but the toggle in the Clerk Dashboard is "Block sign-ups that use disposable email addresses". ignoreDotsForGmailAddresses bolded "Ignore dots for Gmail addresses" as a Dashboard toggle, but no such control exists — the wording now matches the equivalent comment on UpdateRestrictionsParams. Property names are unchanged. (#9253) by @​manovotny

Changelog

Sourced from @​clerk/backend's changelog.

3.16.0

Minor Changes

• Add clerkClient.users.removePassword(userId, params?) to remove a user's password through the Backend API. Password removal is allowed even when the user has no alternate sign-in method configured. Existing sessions remain active by default; pass { signOutOfOtherSessions: true } to revoke them. (#9326) by @​joshrowley

Patch Changes

• Improve generated API reference links, expose BillingSubscriptionItemStatus, and clarify the createUser() identification status documentation. (#9340) by @​SarahSoutoul

• Updated dependencies [1ef84c3, d639048, a66cbbf]:

  • @​clerk/shared@​4.27.0

3.15.1

Patch Changes

• Add the optional emailAddressIdentificationStatus and phoneNumberIdentificationStatus parameters to CreateUserParams. The Backend API has supported these arrays on POST /v1/users since they shipped, but createUser() had no way to pass them, so every email address and phone number was necessarily created verified. Each array runs parallel to emailAddress / phoneNumber — one item per identifier, applied by position — and an item set to 'reserved' creates that identifier unverified but still usable for sign-in and locked so no other user can claim it. (#9305) by @​dmoerner

  The createUser() documentation is corrected accordingly: it stated unconditionally that created email addresses and phone numbers are automatically verified, which is only the default.

• Updated dependencies [5c81479]:

  • @​clerk/shared@​4.26.0

3.15.0

Minor Changes

• Update fields for BillingSubscription and BillingSubscriptionItem (#9196) by @​dstaley

Patch Changes

• Return a TokenVerificationError from decodeJwt and verifyToken for tokens whose header, payload, or signature cannot be decoded. (#9268) by @​wobsoriano

• Updated dependencies [aaea141]:

  • @​clerk/shared@​4.25.10

3.14.0

Minor Changes

• Align the EnterpriseConnection response resource with what the Backend API actually returns: (#9156) by @​manovotny
  • EnterpriseConnection now exposes provider, logoPublicUrl, allowOrganizationAccountLinking, authenticatable, disableJitProvisioning, and customAttributes.
  • EnterpriseConnectionSamlConnection now exposes active, forceAuthn, and loginHint.
  • EnterpriseConnectionOauthConfig now exposes providerKey, authUrl, tokenUrl, userInfoUrl, and requiresPkce.
  • Deprecated properties the Backend API never returns, which were always undefined despite their declared types: allowSubdomains on EnterpriseConnection (use samlConnection.allowSubdomains), and idpMetadata and syncUserAttributes on EnterpriseConnectionSamlConnection (use the top-level syncUserAttributes).
  • organizationId is now normalized to null when the Backend API omits it, matching its declared string | null type. Properties backed by optional API fields (for example oauthConfig.clientId and the SAML IdP fields) are now typed as possibly undefined to match runtime behavior.

Patch Changes

... (truncated)

Commits

• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.