fix(js): Turnstile retry logic

[tmilewski]

Description

• Fix a crash in the Turnstile CAPTCHA retry logic where captcha.reset() was called after the widget's DOM container had already been removed, causing an unhandled error.
• Before retrying on a retriable Turnstile error code, the error-callback now checks whether the widget container still exists in the DOM. If the container has been removed (e.g., due to a component unmount or navigation), the promise is rejected immediately with the accumulated error codes instead of attempting a reset on a stale widget ID.
• Add comprehensive unit tests covering the new container guard: verifying immediate rejection when the container is removed before retry, confirming normal retry behavior when the container is still present, and validating that accumulated error codes are correctly reported.

Test plan

• Container removed before retry fires — rejects immediately, captcha.reset is not called
• Container still exists — captcha.reset proceeds normally
• Multiple errors accumulated before container removal — all error codes included in rejection

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

Summary by CodeRabbit

• Bug Fixes
  • Fixed a crash that could occur with Turnstile CAPTCHA when the widget was removed from the page during a retry attempt.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 20, 2026 9:14pm

[changeset-bot]

🦋 Changeset detected

Latest commit: 4c8b939

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

📝 Walkthrough

Walkthrough

A patch update for @clerk/clerk-js was released to fix a crash in Turnstile CAPTCHA retry logic. The issue occurred when captcha.reset() was called after the widget's DOM container had been removed from the page. The fix adds a guard that checks whether the widget container exists in the DOM before attempting to reset it. If the container is missing, the retry is short-circuited and the promise is rejected with accumulated error codes. Tests were added to verify the behavior in three scenarios: container removal before retry, container persistence during retry, and multiple retries with eventual container removal.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title 'fix(js): Turnstile retry logic' directly and clearly summarizes the main change—a fix to the Turnstile retry logic to prevent crashes when widget containers are removed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7899

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7899

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7899

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7899

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7899

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7899

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7899

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7899

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7899

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7899

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7899

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7899

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7899

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7899

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7899

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7899

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7899

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7899

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7899

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7899

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7899

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7899

commit: 4c8b939

[nikosdouvlis]

The widgetContainerQuerySelector && guard is technically redundant here since it's always assigned before handleCaptchaTokenGeneration is called (lines 98, 124, or 142 guarantee it)

[jacekradko]

@tmilewski Should this be part of core 2?

[tmilewski]

@tmilewski Should this be part of core 2?

Yeah, I'll backport