# What changed in @clerk/backend

> 6 changes in @clerk/backend 3 from its official release notes, upgrade guides and advisories: 1 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/@clerk/backend/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @clerk/backend 3

### Security

- Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host (3.2.3) — [security advisory](https://github.com/advisories/GHSA-GJXX-92W9-8V8F)

### New APIs and options

- Adds webhook types for transactional email delivery, delays, bounces, complaints, failures, and suppressions. (3.26.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.26.0)
- Accepts an optional issuer value to validate the JWT iss claim against a string or list of allowed strings; this applies only to session tokens. Omitting it preserves existing behavior. (3.25.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.25.0)
- Accepts an optional issuer value to validate the JWT iss claim against a string or list of allowed strings. Omitting it preserves existing behavior. (3.25.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.25.0)
- Accepts an optional issuer value to validate the JWT iss claim against a string or list of allowed strings; this applies only to session tokens. Omitting it preserves existing behavior. (3.25.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.25.0)

### Fixes and other changes

- Preserves the original event timestamp and instance ID for outcome handlers. (3.26.0) — [release notes](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.26.0)