Bump @clerk/shared from 4.23.0 to 4.25.5 in /frontend

[dependabot]

Bumps @clerk/shared from 4.23.0 to 4.25.5.

Release notes

Sourced from @​clerk/shared's releases.

@​clerk/shared@​4.25.5

Patch Changes

• Escape <, >, and / when serializing the Clerk auth state into SSR <script> tags, preventing a </script> sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. (#9166) by @​dominic-clerk

@​clerk/shared@​4.25.4

Patch Changes

• Add CLERK_DISABLE_AUTO_PROXY=true to opt out of automatic Frontend API proxying on Vercel production deployments. (#9159) by @​brkalow

@​clerk/shared@​4.25.3

Patch Changes

• Fail fast when the Clerk Frontend API (FAPI) is slow or unreachable during load. The client request and the load-recovery token mint are now bounded by a timeout, and the timed-out client request is aborted instead of being left in flight. A cold Clerk.load() renders identity from a freshly minted session token (falling back to the session cookie if the mint fails) in seconds instead of hanging while retries run. After a degraded load, the client is re-fetched in the background without a time limit, so a slow-but-healthy origin recovers full client data (user profile, other sessions) without a reload. Also fixes hooks like useUser() keeping the cookie-derived stub user after full user data arrives. Adds a timeLimit utility to @clerk/shared/utils that optionally aborts an AbortController on timeout. (#9065) by @​nikosdouvlis

• Add named protect check parameter types for future sign-in and sign-up flows. (#9116) by @​SarahSoutoul

Changelog

Sourced from @​clerk/shared's changelog.

4.25.5

Patch Changes

• Escape <, >, and / when serializing the Clerk auth state into SSR <script> tags, preventing a </script> sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. (#9166) by @​dominic-clerk

4.25.4

Patch Changes

• Add CLERK_DISABLE_AUTO_PROXY=true to opt out of automatic Frontend API proxying on Vercel production deployments. (#9159) by @​brkalow

4.25.3

Patch Changes

• Fail fast when the Clerk Frontend API (FAPI) is slow or unreachable during load. The client request and the load-recovery token mint are now bounded by a timeout, and the timed-out client request is aborted instead of being left in flight. A cold Clerk.load() renders identity from a freshly minted session token (falling back to the session cookie if the mint fails) in seconds instead of hanging while retries run. After a degraded load, the client is re-fetched in the background without a time limit, so a slow-but-healthy origin recovers full client data (user profile, other sessions) without a reload. Also fixes hooks like useUser() keeping the cookie-derived stub user after full user data arrives. Adds a timeLimit utility to @clerk/shared/utils that optionally aborts an AbortController on timeout. (#9065) by @​nikosdouvlis

• Add named protect check parameter types for future sign-in and sign-up flows. (#9116) by @​SarahSoutoul

4.25.2

Patch Changes

• Add a clear button to search inputs for quickly resetting the current query. It appears in the <APIKeys /> search and the <OrganizationProfile /> members search. (#9098) by @​alexcarpenter

  Search inputs now expose a shared searchInput appearance element (layered alongside any existing component-specific element), and the clear button is themeable via the new shared searchInputClearButton element. The clear button's label can be customized with the new shared searchInput.action__clear localization key.

4.25.1

Patch Changes

• Deprecate createPathMatcher() and its pattern types (PathMatcherParam, PathPattern, WithPathSegmentWildcard). Pattern-based path matching is being phased out along with the framework-level createRouteMatcher() helpers and will be removed in the next major version. Use your framework's native routing primitives to decide which paths to protect instead. (#9094) by @​jacekradko

4.25.0

Minor Changes

• Add support for Clerk Protect mid-flow SDK challenges (protect_check) on both sign-up and sign-in. (#8329) by @​zourzouvillys

  When the Protect antifraud service issues a challenge, responses now carry a protectCheck field with { status, token, sdkUrl, expiresAt?, uiHints? }. Clients resolve the gate by loading the SDK at sdkUrl, executing the challenge, and submitting the resulting proof token via signUp.submitProtectCheck({ proofToken }) or signIn.submitProtectCheck({ proofToken }). The response may carry a chained challenge, which the SDK resolves iteratively.

  Sign-in adds a new 'needs_protect_check' value to the SignInStatus union. Upgrading this package is type-only and does not change runtime behavior: the server returns the new status (and the protectCheck field) only for instances where Protect mid-flow challenges have been explicitly enabled — the feature is off by default and is not enabled for existing instances by

... (truncated)

Commits

• b37ba0d ci(repo): Version packages (#9175)
• bcbdda6 fix(astro,tanstack-react-start): Fix XSS via user-controlled JSON (#9166)
• 96bd3f6 ci(repo): Version packages (#9160)
• e162b71 fix(nextjs): add auto proxy opt-out (#9159)
• 56b8683 ci(repo): Version packages (#9141)
• 9c027fa chore(*): fix turbo.json for local dev (#9004)
• d8fc1d7 fix(clerk-js): fail fast when the origin is slow at load (#9065)
• 1d0e78c docs(shared): Improve protect check parameter types and Typedoc output (#9116)
• 3fc812f ci(repo): Version packages (#9117)
• 8dbf343 feat(ui): Add clear button to search inputs (#9098)
• Additional commits viewable in compare view

Summary by CodeRabbit

• Chores
  • Updated the authentication library dependency to a newer version for improved compatibility and maintenance.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-burntbeats-aws	Ready	Preview, Comment, Open in v0	Jul 20, 2026 3:05am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b8bdf84d-dcab-4028-807d-7ce61c04314a

📥 Commits

Reviewing files that changed from the base of the PR and between 37ef0bb and 59f9361.

⛔ Files ignored due to path filters (1)

• frontend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• frontend/package.json

---

📝 Walkthrough

Walkthrough

The frontend dependency manifest updates @clerk/shared from ^4.22.0 to ^4.25.5.

Changes

Clerk dependency update

Layer / File(s)	Summary
Update Clerk shared version frontend/package.json	The @clerk/shared dependency range is updated from ^4.22.0 to ^4.25.5.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Ocean82/burntbeats-aws#62: Updates the same Clerk ecosystem dependency in frontend/package.json.

Suggested reviewers: ocean82

Poem

A rabbit hops through the manifest bright,
Clerk’s shared package takes a newer flight.
One small version, neatly changed,
No other lines have rearranged.

Hop, hop—dependencies aligned!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the dependency bump in /frontend and matches the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}