fix(clerk-js): Stop ssoBypassAllowlist from making Organization circular

[mauricioabreu]

Description

Since #9809, calling JSON.stringify on an Organization (or a User, which reaches organizations through its memberships) throws Converting circular structure to JSON. The ssoBypassAllowlist helper on the organization kept an enumerable reference back to the organization.

The reference is now non-enumerable, so serializing an organization works again and the helper shows up as an empty object.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Team

Run ID: 41aa85b4-6fd3-4505-acc3-ec3d66813b7e

📥 Commits

Reviewing files that changed from the base of the PR and between 39e0da5 and 6c6401f.

📒 Files selected for processing (1)

• .changeset/sso-bypass-allowlist-circular-ref.md

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/cli (auto-detected)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)

💤 Files with no reviewable changes (1)

• .changeset/sso-bypass-allowlist-circular-ref.md

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 6 reviews per hour.

---

📝 Walkthrough

Walkthrough

SSOBypassAllowlist now stores its organization reference as a non-enumerable property. A regression test verifies that Organization can be JSON-stringified and that ssoBypassAllowlist serializes as an empty object. A patch changeset documents the fix.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Severity of issue fixed: Low

Suggested reviewers: dstaley

Merge Risk: ⚪ Minimal · up to 6c640

Organization serialization no longer fails on the allowlist back-reference. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary fix: preventing the ssoBypassAllowlist reference from creating a circular Organization structure.
Description check	✅ Passed	The description directly explains the circular reference, the non-enumerable reference fix, the JSON.stringify impact, and the regression coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Sep 18, 2026 6:56pm UTC
swingset	Ready	Preview	Sep 18, 2026 6:56pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 6c6401f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9828

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9828

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9828

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9828

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9828

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9828

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9828

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9828

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9828

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9828

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9828

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9828

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9828

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9828

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@9828

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9828

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9828

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9828

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9828

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9828

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9828

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9828

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9828

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9828

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9828

commit: 6c6401f

[github-actions]

API Changes Report

Generated by Break Check on 2026-09-18T18:57:39.305Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 6c6401f.}