fix(express): forward clockSkewInMs in clerkMiddleware

[jeremy-clerk]

Description

This fixes an @clerk/express bug where clockSkewInMs was accepted by the middleware options type but not forwarded to backend authenticateRequest().

The change explicitly passes clockSkewInMs through in the Express wrapper and adds a regression test to verify the option is forwarded.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

Verification

• pnpm turbo run test --filter=@clerk/express
• pnpm turbo run build --filter=@clerk/express

[changeset-bot]

🦋 Changeset detected

Latest commit: a5e8270

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clerk/express	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 10, 2026 9:25pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 8168a125-8975-4646-bd78-76033d12a2ff

📥 Commits

Reviewing files that changed from the base of the PR and between 89949d8 and a5e8270.

📒 Files selected for processing (1)

• packages/express/src/__tests__/clerkMiddleware.test.ts

---

📝 Walkthrough

Walkthrough

This pull request forwards the clockSkewInMs option from the Express middleware to the backend authenticateRequest call. It adds a changeset for a patch release of @clerk/express, updates authenticateRequest.ts to extract and pass clockSkewInMs to clerkClient.authenticateRequest, and adds a test verifying the option is forwarded.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: forwarding the clockSkewInMs option through the Express middleware to the backend authenticateRequest function.
Description check	✅ Passed	The description clearly explains the bug being fixed and the solution implemented, providing context about the issue and the changes made.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/express/src/__tests__/clerkMiddleware.test.ts`:
- Around line 120-122: The test uses a type-only import Request at runtime in
expect.any(Request) which fails TypeScript compilation; update the assertion
comparing the first argument to use a runtime-safe matcher (e.g.,
expect.anything() or expect.any(Object)) instead of expect.any(Request) so
authenticateRequestMock is asserted without referencing the type-only Request
symbol at runtime.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 3ddeef75-5ef6-4332-b8a8-aa5c9df1b844

📥 Commits

Reviewing files that changed from the base of the PR and between 68d1d8d and 749515e.

📒 Files selected for processing (3)

• .changeset/red-pans-sing.md
• packages/express/src/__tests__/clerkMiddleware.test.ts
• packages/express/src/authenticateRequest.ts

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8287

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8287

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8287

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8287

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8287

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8287

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8287

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8287

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8287

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8287

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8287

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8287

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8287

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8287

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8287

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8287

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8287

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8287

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8287

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8287

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8287

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8287

commit: a5e8270