fix(repo): pin internal deps to exact versions in canary/snapshot releases

Why this change was needed:
Canary/snapshot releases using `workspace:^` produced dependencies like
`^3.0.0-canary.v20251211` which semver interprets as `>=3.0.0-canary <4.0.0`.
This incorrectly matched older versions like `3.0.0-snapshot.v20251204`,
causing dependency mismatches when installing canary packages.

What changed:
Added `pinWorkspaceDeps()` that converts `workspace:^` to `workspace:*` for
all @clerk/* dependencies before running `changeset version --snapshot`.
This ensures published packages use exact versions (no ^ prefix) for internal
dependencies while keeping the semver range behavior for stable releases.

Author: nikosdouvlis

scripts/canary.mjs

@@ -2,7 +2,7 @@
 
 import { $, echo } from 'zx';
 
-import { constants, getPackageNames } from './common.mjs';
+import { constants, getPackageNames, pinWorkspaceDeps } from './common.mjs';
 
 const packageNames = await getPackageNames();
 const packageEntries = packageNames.map(name => `'${name}': patch`).join('\n');
@@ -31,6 +31,10 @@ try {
 // in order to force a canary release of all packages
 await $`touch .changeset/snap.md && echo ${snapshot} > .changeset/snap.md`;
 
+// Convert workspace:^ to workspace:* for @clerk/* deps to ensure exact versions
+// This prevents semver range issues like ^3.0.0-canary matching older snapshots
+await pinWorkspaceDeps();
+
 const res = await $`pnpm changeset version --snapshot canary`;
 const success = !res.stderr.includes('No unreleased changesets found');
 

scripts/common.mjs

@@ -1,15 +1,20 @@
-import { readFile } from 'fs/promises';
+import { readFile, writeFile } from 'fs/promises';
 import { $ } from 'zx';
 
 export const constants = {
   ChangesetConfigFile: '.changeset/config.json',
 };
 
+export async function getPackageJsonFiles() {
+  const result = await $`find packages -mindepth 2 -maxdepth 2 -name package.json`.quiet();
+  return result.stdout.trim().split('\n').filter(Boolean);
+}
+
 export async function getPackageNames() {
-  const packageJsonFiles = await $`find packages -mindepth 2 -maxdepth 2 -name package.json`.quiet();
+  const packageJsonFiles = await getPackageJsonFiles();
   const packageNames = [];
 
-  for (const file of packageJsonFiles.stdout.trim().split('\n').filter(Boolean)) {
+  for (const file of packageJsonFiles) {
     try {
       const packageJsonContent = await readFile(file, 'utf-8');
       const packageJson = JSON.parse(packageJsonContent);
@@ -23,3 +28,41 @@ export async function getPackageNames() {
 
   return packageNames.sort();
 }
+
+/**
+ * Converts `workspace:^` to `workspace:*` for all @clerk/* dependencies.
+ * This ensures that snapshot/canary releases use exact versions instead of
+ * semver ranges, preventing issues like ^3.0.0-canary.v20251211 matching
+ * older versions like 3.0.0-snapshot.v20251204.
+ */
+export async function pinWorkspaceDeps() {
+  const packageJsonFiles = await getPackageJsonFiles();
+
+  for (const file of packageJsonFiles) {
+    try {
+      const content = await readFile(file, 'utf-8');
+      const packageJson = JSON.parse(content);
+      let modified = false;
+
+      for (const depType of ['dependencies', 'devDependencies', 'peerDependencies']) {
+        const deps = packageJson[depType];
+        if (!deps) {
+          continue;
+        }
+
+        for (const [name, version] of Object.entries(deps)) {
+          if (name.startsWith('@clerk/') && version === 'workspace:^') {
+            deps[name] = 'workspace:*';
+            modified = true;
+          }
+        }
+      }
+
+      if (modified) {
+        await writeFile(file, JSON.stringify(packageJson, null, 2) + '\n');
+      }
+    } catch {
+      // package.json doesn't exist or is invalid, skip
+    }
+  }
+}

scripts/snapshot.mjs

@@ -2,7 +2,7 @@
 
 import { $, argv, echo } from 'zx';
 
-import { constants, getPackageNames } from './common.mjs';
+import { constants, getPackageNames, pinWorkspaceDeps } from './common.mjs';
 
 const packageNames = await getPackageNames();
 const packageEntries = packageNames.map(name => `'${name}': patch`).join('\n');
@@ -33,6 +33,10 @@ try {
 // in order to force a snapshot release of all packages
 await $`touch .changeset/snap.md && echo ${snapshot} > .changeset/snap.md`;
 
+// Convert workspace:^ to workspace:* for @clerk/* deps to ensure exact versions
+// This prevents semver range issues like ^3.0.0-snapshot matching older versions
+await pinWorkspaceDeps();
+
 const res = await $`pnpm changeset version --snapshot ${prefix}`;
 const success = !res.stderr.includes('No unreleased changesets found');