chore(deps): bump @clerk/backend from 2.10.1 to 2.33.3

[dependabot]

Bumps @clerk/backend from 2.10.1 to 2.33.3.

Changelog

Sourced from @​clerk/backend's changelog.

Change Log

3.4.2

Patch Changes

• Auto-proxy FAPI requests for .vercel.app subdomains. When deployed to a .vercel.app domain without explicit proxy or domain configuration, the SDK automatically routes Frontend API requests through /__clerk on the app's own origin. This enables Clerk production mode on Vercel deployments without manual proxy setup. (#8035) by @​brkalow

• Fix Request cloning and outbound fetch to omit cross-realm AbortSignal. Node 24's bundled undici tightened the instanceof AbortSignal check on RequestInit.signal, which broke: (#8351) by @​jacekradko

  • Cloning framework-specific requests such as NextRequest in @clerk/backend's ClerkRequest.
  • Subclassed Requests passed through patchRequest in @clerk/react-router and @clerk/tanstack-react-start.
  • Frontend API proxying in @clerk/backend's clerkFrontendApiProxy, which forwarded the inbound request's signal to the upstream fetch. Abort propagation will be restored in a follow-up via an in-realm AbortController bridge.

• Updated dependencies [9b57986, a9f9b29]:

  • @​clerk/shared@​4.8.6

3.4.1

Patch Changes

• Updated dependencies [da76490]:
  • @​clerk/shared@​4.8.5

3.4.0

Minor Changes

• Add backend query to GET organization settings for an instance. (#8367) by @​dmoerner

Patch Changes

• Updated dependencies [083c4c5, dcaf694]:
  • @​clerk/shared@​4.8.4

3.3.0

Minor Changes

• Add createBootstrapSignedOutState helper to @clerk/backend/internal. Returns a synthetic UnauthenticatedState<'session_token'> without requiring a publishable key or an AuthenticateContext. Intended for framework integrations that need to run authorization logic before real Clerk keys are available (e.g. the Next.js keyless bootstrap window). Accepts optional signInUrl, signUpUrl, isSatellite, domain, and proxyUrl so that createRedirect-driven flows (including cross-origin satellite sign-in with the __clerk_status=needs-sync handshake marker) behave correctly during bootstrap. (#8368) by @​jacekradko

3.2.14

Patch Changes

• A clock skew of 0 will not fall back to the default value anymore. (#8359) by @​dominic-clerk

• Updated dependencies [d52b311]:

  • @​clerk/shared@​4.8.3

3.2.13

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​clerk/backend since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

MCP Security Check

PASSED - No critical vulnerabilities

MCP Vulnerability Summary

Severity	Count	Status
CRITICAL	0	Pass
HIGH	28	Warning
MEDIUM	0	Info

---

MCP project has strict security requirements. Critical vulnerabilities block merge.